network August 2017

network@lists.ipfire.org

2 participants
24 discussions

[PATCH 1/2] ipsec-connection: add color support
by Jonatan Schlag 16 Aug '17

16 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/bash-completion/network | 5 ++++- src/functions/functions.colors | 3 +++ src/functions/functions.ipsec | 14 ++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/src/bash-completion/network b/src/bash-completion/network index 5ddc8db..a25e43b 100644 --- a/src/bash-completion/network +++ b/src/bash-completion/network @@ -413,7 +413,7 @@ _network_vpn_ipsec_connection_subcommands() { shift local words=( $@ ) - local commands="authentication down inactivity-timeout local mode peer remote security-policy show up" + local commands="authentication color down inactivity-timeout local mode peer remote security-policy show up" local cmd="$(_network_find_on_cmdline "${commands}")" if [[ -z "${cmd}" ]]; then COMPREPLY=( $(compgen -W "${commands}" -- "${cur}") ) @@ -426,6 +426,9 @@ _network_vpn_ipsec_connection_subcommands() { authentication) _network_vpn_ipsec_connection_subcommands_authentication ${connection} ${args} ;; + color) + _network_color ${args} + ;; local) _network_vpn_ipsec_connection_subcommands_local_remote ${connection} "local" ${args} ;; diff --git a/src/functions/functions.colors b/src/functions/functions.colors index 121d736..816af48 100644 --- a/src/functions/functions.colors +++ b/src/functions/functions.colors @@ -151,6 +151,9 @@ color_format_filename() { local type=${1} local name=${2} case ${type} in + ipsec-connection) + echo "${NETWORK_IPSEC_CONNS_DIR}/${name}/color" + ;; zone) echo "$(zone_dir ${name})/color" ;; diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 7283836..6a91d39 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -88,6 +88,9 @@ cli_ipsec_connection() { authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|pool|remote|security_policy|start_action|up) ipsec_connection_${key} ${connection} $@ ;; + color) + color_cli "ipsec-connection" "${connection}" "$@" + ;; show) cli_ipsec_connection_show "${connection}" exit $? @@ -173,6 +176,14 @@ cli_ipsec_connection_destroy() { ipsec_strongswan_autostart } +ipsec_connection_get_color() { + # This function return the color of a zone + assert [ $# -eq 1 ] + + local name=${1} + color_read "ipsec-connection" ${name} +} + cli_ipsec_connection_show() { local connection="${1}" @@ -186,6 +197,9 @@ cli_ipsec_connection_show() { cli_headline 0 "IPsec VPN Connection: ${connection}" cli_space + cli_print_fmt1 1 "Color" "$(cli_color_bar $(ipsec_connection_get_color ${connection}))" + cli_space + # Peer if isset PEER; then cli_print_fmt1 1 "Peer" "${PEER}" -- 2.6.3

1 1

[PATCH] ipsec: accept also psk and use pre-shared-key instead of psk
by Jonatan Schlag 16 Aug '17

16 Aug '17

Fixes: #11454 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/bash-completion/network | 2 +- src/functions/functions.ipsec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/bash-completion/network b/src/bash-completion/network index 5ddc8db..15bb9e8 100644 --- a/src/bash-completion/network +++ b/src/bash-completion/network @@ -446,7 +446,7 @@ _network_vpn_ipsec_connection_subcommands_authentication() { shift local words=( $@ ) - local commands="psk mode" + local commands="mode pre-shared-key" local cmd="$(_network_find_on_cmdline "${commands}")" if [[ -z "${cmd}" ]]; then COMPREPLY=( $(compgen -W "${commands}" -- "${cur}") ) diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 7283836..bb0dc2e 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -57,7 +57,7 @@ IPSEC_DEFAULT_START_ACTION="on-demand" IPSEC_DEFAULT_TYPE="net-to-net" IPSEC_VALID_MODES="gre-transport tunnel vti" -IPSEC_VALID_AUTH_MODES="PSK" +IPSEC_VALID_AUTH_MODES="PSK psk" cli_ipsec() { local action=${1} -- 2.6.3

1 0

[PATCH] ipsec: move pool function in a seperated file
by Jonatan Schlag 16 Aug '17

16 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec | 402 ----------------------------------- src/functions/functions.ipsec-pool | 422 +++++++++++++++++++++++++++++++++++++ 2 files changed, 422 insertions(+), 402 deletions(-) create mode 100644 src/functions/functions.ipsec-pool diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 7283836..6d885b8 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -39,11 +39,6 @@ IPSEC_CONNECTION_CONFIG_SETTINGS="\ TYPE \ ENABLED" -IPSEC_POOL_CONFIG_SETTINGS="\ - DNS_SERVER \ - NETWORK \ - TYPE" - # Default values IPSEC_DEFAULT_AUTH_MODE="PSK" IPSEC_DEFAULT_DPD_ACTION="restart" @@ -118,47 +113,6 @@ cli_ipsec_connection() { fi } -cli_ipsec_pool() { - if ipsec_pool_exists ${1}; then - local pool=${1} - local key=${2} - key=${key//-/_} - shift 2 - - case "${key}" in - dns_server|network) - ipsec_pool_${key} ${pool} $@ - ;; - show) - cli_ipsec_pool_show "${pool}" - exit $? - ;; - *) - error "Unrecognized argument: ${key}" - exit ${EXIT_ERROR} - ;; - esac - else - local action=${1} - shift - - case "${action}" in - new) - ipsec_pool_new $@ - ;; - destroy) - ipsec_pool_destroy $@ - ;; - ""|*) - if [ -n "${action}" ]; then - error "Unrecognized argument: '${action}'" - fi - exit ${EXIT_ERROR} - ;; - esac - fi -} - cli_ipsec_connection_destroy() { local connection="${1}" @@ -1520,359 +1474,3 @@ _ipsec_connection_to_strongswan_secrets() { print_indent 0 "}" } - -# This function writes all values to a via ${pool} specificated VPN IPsec pool configuration file -ipsec_pool_write_config() { - assert [ $# -ge 1 ] - - local pool="${1}" - - if ! ipsec_pool_exists "${pool}"; then - log ERROR "No such VPN IPsec pool: ${pool}" - return ${EXIT_ERROR} - fi - - local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings" - - if ! settings_write "${path}" ${IPSEC_POOL_CONFIG_SETTINGS}; then - log ERROR "Could not write configuration settings for VPN IPsec pool ${pool}" - return ${EXIT_ERROR} - fi - - if ! ipsec_pool_reload ${pool}; then - log WARNING "Could not reload IPsec pool ${pool}" - fi - - # When we get here the writing of the config file was successful - return ${EXIT_OK} -} - -# This funtion writes the value for one key to a via ${connection} specificated -# VPN IPsec pool configuration file -ipsec_pool_write_config_key() { - assert [ $# -ge 3 ] - - local pool=${1} - local key=${2} - shift 2 - - local value="$@" - - if ! ipsec_pool_exists "${pool}"; then - log ERROR "No such VPN IPsec pool: ${pool}" - return ${EXIT_ERROR} - fi - - log DEBUG "Set '${key}' to new value '${value}' in VPN IPsec pool '${pool}'" - - local ${IPSEC_POOL_CONFIG_SETTINGS} - - # Read the config settings - if ! ipsec_pool_read_config "${pool}"; then - return ${EXIT_ERROR} - fi - - # Set the key to a new value - assign "${key}" "${value}" - - if ! ipsec_pool_write_config "${pool}"; then - return ${EXIT_ERROR} - fi - - return ${EXIT_TRUE} -} - -# Reads one or more keys out of a settings file or all if no key is provided. -ipsec_pool_read_config() { - assert [ $# -ge 1 ] - - local pool="${1}" - shift 1 - - if ! ipsec_pool_exists "${pool}"; then - log ERROR "No such VPN IPsec pool : ${pool}" - return ${EXIT_ERROR} - fi - - local args - if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then - list_append args ${IPSEC_POOL_CONFIG_SETTINGS} - else - list_append args $@ - fi - - local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings" - - if ! settings_read "${path}" ${args}; then - log ERROR "Could not read settings for VPN IPsec pool ${pool}" - return ${EXIT_ERROR} - fi -} - -# This function checks if a vpn IPsec pool exists -# Returns True when yes and false when not -ipsec_pool_exists() { - assert [ $# -eq 1 ] - - local pool=${1} - - local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}" - - [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE} -} - -# This function checks if a VPN IPsec pool name is valid -# Allowed are only A-Za-z0-9 -ipsec_pool_check_name() { - assert [ $# -eq 1 ] - - local pool=${1} - - # These are special words in strongswan - if isoneof pool dhcp radius; then - return ${EXIT_ERROR} - fi - - [[ "${pool}" =~ [^[:alnum:]$] ]] -} - -ipsec_pool_new() { - if [ $# -gt 1 ]; then - error "Too many arguments" - return ${EXIT_ERROR} - fi - - local pool="${1}" - if ! isset pool; then - error "Please provide a pool name" - return ${EXIT_ERROR} - fi - - # Check for duplicates - if ipsec_pool_exists "${pool}"; then - error "The VPN IPsec pool ${pool} already exists" - return ${EXIT_ERROR} - fi - - # Check if the name of the connection is valid - if ipsec_pool_check_name "${pool}"; then - error "'${pool}' contains illegal characters" - return ${EXIT_ERROR} - fi - - log DEBUG "Creating VPN IPsec pool ${pool}" - - if ! mkdir -p "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then - log ERROR "Could not create config directory for ${pool}" - return ${EXIT_ERROR} - fi - - local ${IPSEC_POOL_CONFIG_SETTINGS} - - if ! ipsec_pool_write_config "${pool}"; then - log ERROR "Could not write new config file" - return ${EXIT_ERROR} - fi -} - -# Function that deletes based on the passed parameters -# one ore more vpn ipsec pools -ipsec_pool_destroy() { - local pool - for pool in $@; do - if ! ipsec_pool_exists "${pool}"; then - log ERROR "The VPN IPsec pool ${pool} does not exist." - continue - fi - - log DEBUG "Deleting VPN IPsec pool ${pool}" - - if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then - log ERROR "Deleting the VPN IPsec pool ${pool} was not sucessful" - return ${EXIT_ERROR} - fi - done -} - -ipsec_pool_set_type() { - local pool=${1} - local ip=${2} - assert isset pool - assert isset ip - - local type=$(ip_detect_protocol ${ip}) - - if ! isset type; then - error "Cannot detect IP protocol of ${ip}" - return ${EXIT_ERROR} - else - log DEBUG "IP protocol of ${ip} is ${type}" - if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${type}; then - log ERROR "Could not write configuration settings" - return ${EXIT_ERROR} - fi - fi -} - -ipsec_pool_network() { - if [ ! $# -eq 2 ]; then - log ERROR "Not enough arguments" - return ${EXIT_ERROR} - fi - local pool=${1} - local network=${2} - - local TYPE - if ! ipsec_pool_read_config ${pool} "TYPE"; then - error "Failed to read configuration settings for pool '${pool}'" - return ${EXIT_ERROR} - fi - - if ! isset TYPE; then - if ! ip_net_is_valid ${network}; then - log ERROR "Network '${network}' is invalid" - return ${EXIT_ERROR} - fi - - if ! ipsec_pool_set_type ${pool} ${network}; then - log ERROR "Could not set type for IPsec pool ${pool}" - return ${EXIT_ERROR} - fi - else - if ! ${TYPE}_net_is_valid ${network}; then - log ERROR "Network '${network}' is invalid" - return ${EXIT_ERROR} - fi - fi - - if ! ipsec_pool_write_config_key "${pool}" "NETWORK" ${network}; then - log ERROR "Could not write configuration settings" - return ${EXIT_ERROR} - fi -} - -ipsec_pool_dns_server() { - if [ ! $# -eq 2 ]; then - log ERROR "Not enough arguments" - return ${EXIT_ERROR} - fi - local pool=${1} - local dns_server=${2} - - local TYPE - if ! ipsec_pool_read_config ${pool} "TYPE"; then - error "Failed to read configuration settings for pool '${pool}'" - return ${EXIT_ERROR} - fi - - if ! isset TYPE; then - if ! ip_is_valid ${dns_server}; then - log ERROR "DNS server '${dns_server}' is invalid" - return ${EXIT_ERROR} - fi - - if ! ipsec_pool_set_type ${pool} ${dns_server}; then - log ERROR "Could not set type for IPsec pool ${pool}" - return ${EXIT_ERROR} - fi - else - if ! ${TYPE}_is_valid ${dns_server}; then - log ERROR "DNS server '${dns_server}' is invalid" - return ${EXIT_ERROR} - fi - fi - - if ! ipsec_pool_write_config_key "${pool}" "DNS_SERVER" ${dns_server}; then - log ERROR "Could not write configuration settings" - return ${EXIT_ERROR} - fi -} - -ipsec_pool_check_config() { - local pool=${1} - assert isset pool - - local ${IPSEC_POOL_CONFIG_SETTINGS} - if ! ipsec_pool_read_config "${pool}"; then - log ERROR "Could not read configuration settings" - return ${EXIT_ERROR} - fi - - if ! isset NETWORK; then - log ERROR "Network for IPSec pool ${pool} is not set" - return ${EXIT_ERROR} - fi - - if ! isset TYPE; then - TYPE=$(ip_detect_protocol ${NETWORK}) - log DEBUG "IP protocol of ${NETWORK} is ${TYPE}" - if ! isset TYPE; then - error "Cannot detect IP protocol of ${NETWORK}" - return ${EXIT_ERROR} - else - if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${TYPE}; then - log ERROR "Could not write configuration settings" - return ${EXIT_ERROR} - fi - fi - else - if ! ${TYPE}_net_is_valid ${NETWORK}; then - log ERROR "NETWORK '${NETWORK}' is invalid" - return ${EXIT_ERROR} - fi - - if isset DNS_SERVER && ! ${TYPE}_is_valid ${DNS_SERVER}; then - log ERROR "DNS server '${DNS_SERVER}' is invalid" - return ${EXIT_ERROR} - fi - fi - - return ${EXIT_OK} -} - -ipsec_pool_reload() { - local pool=${1} - - if ! ipsec_pool_to_strongswan ${pool}; then - log ERROR "Could not generate strongswan config for ${pool}" - return ${EXIT_ERROR} - fi - - ipsec_strongswan_load -} - -ipsec_pool_to_strongswan() { - local pool=${1} - - log DEBUG "Generating IPsec pool config for ${pool}" - - local ${IPSEC_POOL_CONFIG_SETTINGS} - if ! ipsec_pool_read_config "${pool}"; then - return ${EXIT_ERROR} - fi - - if isset NETWORK && ! ipsec_pool_check_config "${pool}"; then - log ERROR "Configuration of ${pool} seems to be invalid" - return ${EXIT_ERROR} - fi - - local path="${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf" - - ( - config_header "strongSwan pool configuration" - - if isset NETWORK; then - print_indent 0 "pools {" - - print_indent 1 "${pool} {" - print_indent 2 "addrs = ${NETWORK}" - - if isset DNS_SERVER; then - print_indent 2 "dns = ${DNS_SERVER}" - fi - - print_indent 1 "}" - print_indent 0 "}" - fi - ) > ${path} -} diff --git a/src/functions/functions.ipsec-pool b/src/functions/functions.ipsec-pool new file mode 100644 index 0000000..4699c7f --- /dev/null +++ b/src/functions/functions.ipsec-pool @@ -0,0 +1,422 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2017 IPFire Network Development Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +IPSEC_POOL_CONFIG_SETTINGS="\ + DNS_SERVER \ + NETWORK \ + TYPE" + +cli_ipsec_pool() { + if ipsec_pool_exists ${1}; then + local pool=${1} + local key=${2} + key=${key//-/_} + shift 2 + + case "${key}" in + dns_server|network) + ipsec_pool_${key} ${pool} $@ + ;; + show) + cli_ipsec_pool_show "${pool}" + exit $? + ;; + *) + error "Unrecognized argument: ${key}" + exit ${EXIT_ERROR} + ;; + esac + else + local action=${1} + shift + + case "${action}" in + new) + ipsec_pool_new $@ + ;; + destroy) + ipsec_pool_destroy $@ + ;; + ""|*) + if [ -n "${action}" ]; then + error "Unrecognized argument: '${action}'" + fi + exit ${EXIT_ERROR} + ;; + esac + fi +} + +# This function writes all values to a via ${pool} specificated VPN IPsec pool configuration file +ipsec_pool_write_config() { + assert [ $# -ge 1 ] + + local pool="${1}" + + if ! ipsec_pool_exists "${pool}"; then + log ERROR "No such VPN IPsec pool: ${pool}" + return ${EXIT_ERROR} + fi + + local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings" + + if ! settings_write "${path}" ${IPSEC_POOL_CONFIG_SETTINGS}; then + log ERROR "Could not write configuration settings for VPN IPsec pool ${pool}" + return ${EXIT_ERROR} + fi + + if ! ipsec_pool_reload ${pool}; then + log WARNING "Could not reload IPsec pool ${pool}" + fi + + # When we get here the writing of the config file was successful + return ${EXIT_OK} +} + +# This funtion writes the value for one key to a via ${connection} specificated +# VPN IPsec pool configuration file +ipsec_pool_write_config_key() { + assert [ $# -ge 3 ] + + local pool=${1} + local key=${2} + shift 2 + + local value="$@" + + if ! ipsec_pool_exists "${pool}"; then + log ERROR "No such VPN IPsec pool: ${pool}" + return ${EXIT_ERROR} + fi + + log DEBUG "Set '${key}' to new value '${value}' in VPN IPsec pool '${pool}'" + + local ${IPSEC_POOL_CONFIG_SETTINGS} + + # Read the config settings + if ! ipsec_pool_read_config "${pool}"; then + return ${EXIT_ERROR} + fi + + # Set the key to a new value + assign "${key}" "${value}" + + if ! ipsec_pool_write_config "${pool}"; then + return ${EXIT_ERROR} + fi + + return ${EXIT_TRUE} +} + +# Reads one or more keys out of a settings file or all if no key is provided. +ipsec_pool_read_config() { + assert [ $# -ge 1 ] + + local pool="${1}" + shift 1 + + if ! ipsec_pool_exists "${pool}"; then + log ERROR "No such VPN IPsec pool : ${pool}" + return ${EXIT_ERROR} + fi + + local args + if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then + list_append args ${IPSEC_POOL_CONFIG_SETTINGS} + else + list_append args $@ + fi + + local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings" + + if ! settings_read "${path}" ${args}; then + log ERROR "Could not read settings for VPN IPsec pool ${pool}" + return ${EXIT_ERROR} + fi +} + +# This function checks if a vpn IPsec pool exists +# Returns True when yes and false when not +ipsec_pool_exists() { + assert [ $# -eq 1 ] + + local pool=${1} + + local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}" + + [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE} +} + +# This function checks if a VPN IPsec pool name is valid +# Allowed are only A-Za-z0-9 +ipsec_pool_check_name() { + assert [ $# -eq 1 ] + + local pool=${1} + + # These are special words in strongswan + if isoneof pool dhcp radius; then + return ${EXIT_ERROR} + fi + + [[ "${pool}" =~ [^[:alnum:]$] ]] +} + +ipsec_pool_new() { + if [ $# -gt 1 ]; then + error "Too many arguments" + return ${EXIT_ERROR} + fi + + local pool="${1}" + if ! isset pool; then + error "Please provide a pool name" + return ${EXIT_ERROR} + fi + + # Check for duplicates + if ipsec_pool_exists "${pool}"; then + error "The VPN IPsec pool ${pool} already exists" + return ${EXIT_ERROR} + fi + + # Check if the name of the connection is valid + if ipsec_pool_check_name "${pool}"; then + error "'${pool}' contains illegal characters" + return ${EXIT_ERROR} + fi + + log DEBUG "Creating VPN IPsec pool ${pool}" + + if ! mkdir -p "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then + log ERROR "Could not create config directory for ${pool}" + return ${EXIT_ERROR} + fi + + local ${IPSEC_POOL_CONFIG_SETTINGS} + + if ! ipsec_pool_write_config "${pool}"; then + log ERROR "Could not write new config file" + return ${EXIT_ERROR} + fi +} + +# Function that deletes based on the passed parameters +# one ore more vpn ipsec pools +ipsec_pool_destroy() { + local pool + for pool in $@; do + if ! ipsec_pool_exists "${pool}"; then + log ERROR "The VPN IPsec pool ${pool} does not exist." + continue + fi + + log DEBUG "Deleting VPN IPsec pool ${pool}" + + if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then + log ERROR "Deleting the VPN IPsec pool ${pool} was not sucessful" + return ${EXIT_ERROR} + fi + done +} + +ipsec_pool_set_type() { + local pool=${1} + local ip=${2} + assert isset pool + assert isset ip + + local type=$(ip_detect_protocol ${ip}) + + if ! isset type; then + error "Cannot detect IP protocol of ${ip}" + return ${EXIT_ERROR} + else + log DEBUG "IP protocol of ${ip} is ${type}" + if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${type}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + fi +} + +ipsec_pool_network() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local pool=${1} + local network=${2} + + local TYPE + if ! ipsec_pool_read_config ${pool} "TYPE"; then + error "Failed to read configuration settings for pool '${pool}'" + return ${EXIT_ERROR} + fi + + if ! isset TYPE; then + if ! ip_net_is_valid ${network}; then + log ERROR "Network '${network}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_pool_set_type ${pool} ${network}; then + log ERROR "Could not set type for IPsec pool ${pool}" + return ${EXIT_ERROR} + fi + else + if ! ${TYPE}_net_is_valid ${network}; then + log ERROR "Network '${network}' is invalid" + return ${EXIT_ERROR} + fi + fi + + if ! ipsec_pool_write_config_key "${pool}" "NETWORK" ${network}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +ipsec_pool_dns_server() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local pool=${1} + local dns_server=${2} + + local TYPE + if ! ipsec_pool_read_config ${pool} "TYPE"; then + error "Failed to read configuration settings for pool '${pool}'" + return ${EXIT_ERROR} + fi + + if ! isset TYPE; then + if ! ip_is_valid ${dns_server}; then + log ERROR "DNS server '${dns_server}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_pool_set_type ${pool} ${dns_server}; then + log ERROR "Could not set type for IPsec pool ${pool}" + return ${EXIT_ERROR} + fi + else + if ! ${TYPE}_is_valid ${dns_server}; then + log ERROR "DNS server '${dns_server}' is invalid" + return ${EXIT_ERROR} + fi + fi + + if ! ipsec_pool_write_config_key "${pool}" "DNS_SERVER" ${dns_server}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +ipsec_pool_check_config() { + local pool=${1} + assert isset pool + + local ${IPSEC_POOL_CONFIG_SETTINGS} + if ! ipsec_pool_read_config "${pool}"; then + log ERROR "Could not read configuration settings" + return ${EXIT_ERROR} + fi + + if ! isset NETWORK; then + log ERROR "Network for IPSec pool ${pool} is not set" + return ${EXIT_ERROR} + fi + + if ! isset TYPE; then + TYPE=$(ip_detect_protocol ${NETWORK}) + log DEBUG "IP protocol of ${NETWORK} is ${TYPE}" + if ! isset TYPE; then + error "Cannot detect IP protocol of ${NETWORK}" + return ${EXIT_ERROR} + else + if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${TYPE}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + fi + else + if ! ${TYPE}_net_is_valid ${NETWORK}; then + log ERROR "NETWORK '${NETWORK}' is invalid" + return ${EXIT_ERROR} + fi + + if isset DNS_SERVER && ! ${TYPE}_is_valid ${DNS_SERVER}; then + log ERROR "DNS server '${DNS_SERVER}' is invalid" + return ${EXIT_ERROR} + fi + fi + + return ${EXIT_OK} +} + +ipsec_pool_reload() { + local pool=${1} + + if ! ipsec_pool_to_strongswan ${pool}; then + log ERROR "Could not generate strongswan config for ${pool}" + return ${EXIT_ERROR} + fi + + ipsec_strongswan_load +} + +ipsec_pool_to_strongswan() { + local pool=${1} + + log DEBUG "Generating IPsec pool config for ${pool}" + + local ${IPSEC_POOL_CONFIG_SETTINGS} + if ! ipsec_pool_read_config "${pool}"; then + return ${EXIT_ERROR} + fi + + if isset NETWORK && ! ipsec_pool_check_config "${pool}"; then + log ERROR "Configuration of ${pool} seems to be invalid" + return ${EXIT_ERROR} + fi + + local path="${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf" + + ( + config_header "strongSwan pool configuration" + + if isset NETWORK; then + print_indent 0 "pools {" + + print_indent 1 "${pool} {" + print_indent 2 "addrs = ${NETWORK}" + + if isset DNS_SERVER; then + print_indent 2 "dns = ${DNS_SERVER}" + fi + + print_indent 1 "}" + print_indent 0 "}" + fi + ) > ${path} +} -- 2.6.3

1 0

[PATCH] network fix parameter passing when using ""
by Jonatan Schlag 16 Aug '17

16 Aug '17

When we use "" on the command line to pass a value with spaces the argument was broken when passing it to the next function. Now the argument is kept as one string with spaces Fixes: #11438 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.bonding | 4 +- src/functions/functions.bridge | 4 +- src/functions/functions.cli.firewall | 16 +-- src/functions/functions.device | 8 +- src/functions/functions.dhcpd | 38 +++---- src/functions/functions.distro | 4 +- src/functions/functions.dns | 6 +- src/functions/functions.editor | 2 +- src/functions/functions.firewall | 4 +- src/functions/functions.firewall-zones | 6 +- src/functions/functions.he | 6 +- src/functions/functions.hook | 8 +- src/functions/functions.hostapd | 12 +- src/functions/functions.http | 6 +- src/functions/functions.interrupts | 2 +- src/functions/functions.ip | 4 +- src/functions/functions.ip-tunnel | 12 +- src/functions/functions.ipsec | 50 ++++----- src/functions/functions.iptables | 12 +- src/functions/functions.ipv4 | 10 +- src/functions/functions.ipv6 | 18 +-- src/functions/functions.list | 20 ++-- src/functions/functions.modem | 6 +- src/functions/functions.ports | 18 +-- src/functions/functions.ppp | 34 +++--- src/functions/functions.pppoe-server | 14 +-- src/functions/functions.route | 64 +++++------ src/functions/functions.settings | 20 ++-- src/functions/functions.util | 10 +- src/functions/functions.vpn | 4 +- src/functions/functions.vpn-security-policies | 16 +-- src/functions/functions.wireless | 12 +- src/functions/functions.wpa_supplicant | 8 +- src/functions/functions.zone | 56 +++++----- src/header-config | 2 +- src/header-port | 8 +- src/header-zone | 10 +- src/hooks/configs/dhcp | 2 +- src/hooks/configs/ipv4-static | 4 +- src/hooks/configs/ipv6-auto | 4 +- src/hooks/configs/ipv6-static | 2 +- src/hooks/configs/pppoe-server | 10 +- src/hooks/ports/batman-adv | 10 +- src/hooks/ports/bonding | 14 +-- src/hooks/ports/dummy | 4 +- src/hooks/ports/vlan | 8 +- src/hooks/ports/wireless-adhoc | 16 +-- src/hooks/ports/wireless-ap | 20 ++-- src/hooks/zones/6to4-tunnel | 14 +-- src/hooks/zones/bridge | 4 +- src/hooks/zones/modem | 20 ++-- src/hooks/zones/pppoe | 12 +- src/hooks/zones/wireless | 10 +- src/network | 152 +++++++++++++------------- 54 files changed, 420 insertions(+), 420 deletions(-) diff --git a/src/functions/functions.bonding b/src/functions/functions.bonding index 490ac2e..afa3306 100644 --- a/src/functions/functions.bonding +++ b/src/functions/functions.bonding @@ -35,10 +35,10 @@ bonding_create() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - address=$(cli_get_val ${1}) + address=$(cli_get_val "${1}") ;; --mode=*) - mode=$(cli_get_val ${1}) + mode=$(cli_get_val "${1}") ;; *) error "Unrecognized argument: ${1}" diff --git a/src/functions/functions.bridge b/src/functions/functions.bridge index 5b817fb..38f51ed 100644 --- a/src/functions/functions.bridge +++ b/src/functions/functions.bridge @@ -30,10 +30,10 @@ bridge_create() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - address=$(cli_get_val ${1}) + address=$(cli_get_val "${1}") ;; --mtu=*) - mtu=$(cli_get_val ${1}) + mtu=$(cli_get_val "${1}") ;; *) error "Unrecognized argument: ${1}" diff --git a/src/functions/functions.cli.firewall b/src/functions/functions.cli.firewall index ffd3a65..74cb652 100644 --- a/src/functions/functions.cli.firewall +++ b/src/functions/functions.cli.firewall @@ -58,7 +58,7 @@ firewall_cli() { ;; zone) - firewall_cli_zone $@ + firewall_cli_zone "$@" ;; ""|help|--help|-h) @@ -81,7 +81,7 @@ firewall_cli_panic() { assert isset protocol shift - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man firewall-panic exit ${EXIT_OK} fi @@ -104,7 +104,7 @@ firewall_cli_panic() { } firewall_cli_settings() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man firewall-settings exit ${EXIT_OK} fi @@ -122,7 +122,7 @@ firewall_cli_zone() { assert isset protocol shift - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man firewall-zone exit ${EXIT_OK} fi @@ -143,15 +143,15 @@ firewall_cli_zone() { # Process the given action. case "${action}" in edit) - firewall_cli_zone_edit ${zone} $@ + firewall_cli_zone_edit ${zone} "$@" ;; status|"") - firewall_cli_zone_status ${zone} $@ + firewall_cli_zone_status ${zone} "$@" ;; # Print the raw configuration settings. show) - firewall_zone_print ${zone} $@ + firewall_zone_print ${zone} "$@" exit ${EXIT_ERROR} ;; @@ -168,7 +168,7 @@ firewall_cli_zone() { case "${action}" in reset) - firewall_zone_reset $@ + firewall_zone_reset "$@" exit $? ;; diff --git a/src/functions/functions.device b/src/functions/functions.device index 897f812..12bf203 100644 --- a/src/functions/functions.device +++ b/src/functions/functions.device @@ -320,11 +320,11 @@ device_get_phy() { } device_is_phy() { - phy_exists $@ + phy_exists "$@" } device_is_serial() { - serial_exists $@ + serial_exists "$@" } # Returns true if a device is a tun device @@ -540,7 +540,7 @@ device_set_promisc() { # Check if the device is free device_is_free() { - ! device_is_used $@ + ! device_is_used "$@" } # Check if the device is used @@ -775,7 +775,7 @@ device_identify() { seconds="$(cli_get_val "${arg}")" ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" assert isinteger seconds diff --git a/src/functions/functions.dhcpd b/src/functions/functions.dhcpd index 7d32c39..3b1214f 100644 --- a/src/functions/functions.dhcpd +++ b/src/functions/functions.dhcpd @@ -118,7 +118,7 @@ dhcpd_service() { } dhcpd_start() { - local services=$(dhcpd_service $@) + local services=$(dhcpd_service "$@") local service for service in ${services}; do @@ -127,7 +127,7 @@ dhcpd_start() { } dhcpd_stop() { - local services=$(dhcpd_service $@) + local services=$(dhcpd_service "$@") local service for service in ${services}; do @@ -138,7 +138,7 @@ dhcpd_stop() { dhcpd_restart() { # DHCP does not support a reload, so # we retsart it. - local services=$(dhcpd_service $@) + local services=$(dhcpd_service "$@") local service for service in ${services}; do @@ -147,11 +147,11 @@ dhcpd_restart() { } dhcpd_reload() { - dhcpd_restart $@ + dhcpd_restart "$@" } dhcpd_enable() { - local services=$(dhcpd_service $@) + local services=$(dhcpd_service "$@") local service for service in ${services}; do @@ -160,7 +160,7 @@ dhcpd_enable() { } dhcpd_disable() { - local services=$(dhcpd_service $@) + local services=$(dhcpd_service "$@") local service for service in ${services}; do @@ -181,10 +181,10 @@ dhcpd_edit() { case "${proto}" in ipv6) - _dhcpd_edit_ipv6 $@ || return $? + _dhcpd_edit_ipv6 "$@" || return $? ;; ipv4) - _dhcpd_edit_ipv4 $@ || return $? + _dhcpd_edit_ipv4 "$@" || return $? ;; esac @@ -197,7 +197,7 @@ _dhcpd_edit_ipv4() { while [ $# -gt 0 ]; do case "${1}" in --authoritative=*) - val=$(cli_get_val ${1}) + val=$(cli_get_val "${1}") if enabled val; then AUTHORITATIVE="true" @@ -206,7 +206,7 @@ _dhcpd_edit_ipv4() { fi ;; --default-lease-time=*) - local val=$(cli_get_val ${1}) + local val=$(cli_get_val "${1}") DEFAULT_LEASE_TIME=$(parse_time ${val}) if ! isinteger DEFAULT_LEASE_TIME; then @@ -215,7 +215,7 @@ _dhcpd_edit_ipv4() { fi ;; --max-lease-time=*) - local val=$(cli_get_val ${1}) + local val=$(cli_get_val "${1}") MAX_LEASE_TIME=$(parse_time ${val}) if ! isinteger MAX_LEASE_TIME; then @@ -224,7 +224,7 @@ _dhcpd_edit_ipv4() { fi ;; --min-lease-time=*) - local val=$(cli_get_val ${1}) + local val=$(cli_get_val "${1}") MIN_LEASE_TIME=$(parse_time ${val}) if isset MIN_LEASE_TIME; then @@ -252,7 +252,7 @@ _dhcpd_edit_ipv6() { while [ $# -gt 0 ]; do case "${1}" in --preferred-lifetime=*) - local val=$(cli_get_val ${1}) + local val=$(cli_get_val "${1}") PREFERRED_LIFETIME=$(parse_time ${val}) if ! isinteger PREFERRED_LIFETIME; then @@ -261,7 +261,7 @@ _dhcpd_edit_ipv6() { fi ;; --valid-lifetime=*) - local val=$(cli_get_val ${1}) + local val=$(cli_get_val "${1}") VALID_LIFETIME=$(parse_time ${val}) if ! isinteger VALID_LIFETIME; then @@ -512,7 +512,7 @@ dhcpd_subnet_match() { } dhcpd_subnet_exists() { - dhcpd_subnet_match $@ + dhcpd_subnet_match "$@" } dhcpd_subnet_new() { @@ -520,7 +520,7 @@ dhcpd_subnet_new() { assert isset proto shift - dhcpd_subnet_edit ${proto} "new" $@ + dhcpd_subnet_edit ${proto} "new" "$@" } dhcpd_subnet_edit() { @@ -557,7 +557,7 @@ dhcpd_subnet_edit() { case "${proto},${mode},${1}" in # Common options ipv6,new,*:*/*|ipv4,new,*.*.*.*/*) - local subnet="$(cli_get_val ${1})" + local subnet="$(cli_get_val "${1}")" ADDRESS="$(ip_split_prefix ${subnet})" PREFIX="$(ip_get_prefix ${subnet})" @@ -617,7 +617,7 @@ dhcpd_subnet_edit() { # IPv4 options ipv4,*,--routers=*) - ROUTERS=$(cli_get_val ${1}) + ROUTERS=$(cli_get_val "${1}") ;; *) @@ -948,7 +948,7 @@ dhcpd_subnet_settings() { } dhcpd_subnet_options_file() { - local path=$(dhcpd_subnet_path $@) + local path=$(dhcpd_subnet_path "$@") assert isset path print "${path}/options" diff --git a/src/functions/functions.distro b/src/functions/functions.distro index 4dc831b..6978233 100644 --- a/src/functions/functions.distro +++ b/src/functions/functions.distro @@ -26,8 +26,8 @@ __os_release() { local line k v while read line; do - k=$(cli_get_key ${line}) - v=$(cli_get_val ${line}) + k=$(cli_get_key "${line}") + v=$(cli_get_val "${line}") if [ "${what}" = "${k}" ]; then echo "${v//\"/}" diff --git a/src/functions/functions.dns b/src/functions/functions.dns index a54feec..e7c3e47 100644 --- a/src/functions/functions.dns +++ b/src/functions/functions.dns @@ -199,13 +199,13 @@ dns_server_parse_line() { while read -r arg; do case "${arg}" in server=*) - server=$(cli_get_val ${arg}) + server=$(cli_get_val "${arg}") ;; priority=*) - priority=$(cli_get_val ${arg}) + priority=$(cli_get_val "${arg}") ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" # The server address must be set. isset server || return ${EXIT_ERROR} diff --git a/src/functions/functions.editor b/src/functions/functions.editor index f362a6f..6edac62 100644 --- a/src/functions/functions.editor +++ b/src/functions/functions.editor @@ -121,7 +121,7 @@ editor_check() { shift # Execute the check function - "${check_func}" $@ + "${check_func}" "$@" local ret="${?}" case "${ret}" in diff --git a/src/functions/functions.firewall b/src/functions/functions.firewall index a503c62..58a2aa4 100644 --- a/src/functions/functions.firewall +++ b/src/functions/functions.firewall @@ -740,9 +740,9 @@ _firewall_parse_rule_line() { return ${EXIT_ERROR} fi - val=$(cli_get_val ${arg}) + val=$(cli_get_val "${arg}") assign "${key}" "${val}" - done <<< "$(args $@)" + done <<< "$(args "$@")" # action must always be set. if ! isset action; then diff --git a/src/functions/functions.firewall-zones b/src/functions/functions.firewall-zones index a72bb8e..6b06fdf 100644 --- a/src/functions/functions.firewall-zones +++ b/src/functions/functions.firewall-zones @@ -44,7 +44,7 @@ firewall_zone_config() { } firewall_zone_exists() { - local file=$(firewall_zone_config $@) + local file=$(firewall_zone_config "$@") [ -r "${file}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE} } @@ -106,10 +106,10 @@ firewall_zone_edit() { while [ $# -gt 0 ]; do case "${1}" in --masquerade4=*) - MASQUERADE4=$(cli_get_val ${1}) + MASQUERADE4=$(cli_get_val "${1}") ;; --policy=*) - POLICY=$(cli_get_val ${1}) + POLICY=$(cli_get_val "${1}") ;; *) warning "Unknown option: ${1}" diff --git a/src/functions/functions.he b/src/functions/functions.he index 205170c..0a73585 100644 --- a/src/functions/functions.he +++ b/src/functions/functions.he @@ -27,13 +27,13 @@ he_tunnelbroker_endpoint_update() { while [ $# -gt 0 ]; do case "${1}" in --username=*) - username="$(cli_get_val ${1})" + username="$(cli_get_val "${1}")" ;; --password=*) - password="$(cli_get_val ${1})" + password="$(cli_get_val "${1}")" ;; --tunnel-id=*) - tunnel_id="$(cli_get_val ${1})" + tunnel_id="$(cli_get_val "${1}")" ;; esac shift diff --git a/src/functions/functions.hook b/src/functions/functions.hook index b8049db..601baee 100644 --- a/src/functions/functions.hook +++ b/src/functions/functions.hook @@ -155,11 +155,11 @@ config_get_hook() { } hook_zone_exists() { - hook_exists zone $@ + hook_exists zone "$@" } hook_zone_exec() { - hook_exec zone $@ + hook_exec zone "$@" } hook_zone_get_all() { @@ -167,11 +167,11 @@ hook_zone_get_all() { } hook_config_exists() { - hook_exists config $@ + hook_exists config "$@" } hook_config_exec() { - hook_exec config $@ + hook_exec config "$@" } hook_config_get_all() { diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd index f7bf2fa..8645828 100644 --- a/src/functions/functions.hostapd +++ b/src/functions/functions.hostapd @@ -44,13 +44,13 @@ hostapd_config_write() { while [ $# -gt 0 ]; do case "${1}" in --broadcast-ssid=*) - broadcast_ssid=$(cli_get_val ${1}) + broadcast_ssid=$(cli_get_val "${1}") ;; --channel=*) - channel=$(cli_get_val ${1}) + channel=$(cli_get_val "${1}") ;; --encryption=*) - encryption=$(cli_get_val ${1}) + encryption=$(cli_get_val "${1}") ;; --ieee80211d=*) local val="$(cli_get_val "${1}")" @@ -61,13 +61,13 @@ hostapd_config_write() { fi ;; --key=*) - key=$(cli_get_val ${1}) + key=$(cli_get_val "${1}") ;; --mode=*) - mode=$(cli_get_val ${1}) + mode=$(cli_get_val "${1}") ;; --ssid=*) - ssid=$(cli_get_val ${1}) + ssid=$(cli_get_val "${1}") ;; --wmm=*) local val="$(cli_get_val "${1}")" diff --git a/src/functions/functions.http b/src/functions/functions.http index 693f9f8..f33aeb6 100644 --- a/src/functions/functions.http +++ b/src/functions/functions.http @@ -34,10 +34,10 @@ http_GET() { while [ $# -gt 0 ]; do case "${1}" in --username=*) - username="$(cli_get_val ${1})" + username="$(cli_get_val "${1}")" ;; --password=*) - password="$(cli_get_val ${1})" + password="$(cli_get_val "${1}")" ;; *) break @@ -46,7 +46,7 @@ http_GET() { shift done - local url="$(cli_get_val ${1})" + local url="$(cli_get_val "${1}")" shift # Add credentials to the URL. diff --git a/src/functions/functions.interrupts b/src/functions/functions.interrupts index 4e089d3..3bd2c01 100644 --- a/src/functions/functions.interrupts +++ b/src/functions/functions.interrupts @@ -99,7 +99,7 @@ __bitmap_to_processor_ids() { } __processor_id_to_bitmap() { - hex $(( 1 << $@ )) + hex $(( 1 << "$@" )) } interrupt_set_smp_affinity() { diff --git a/src/functions/functions.ip b/src/functions/functions.ip index d6fd76d..3b43da7 100644 --- a/src/functions/functions.ip +++ b/src/functions/functions.ip @@ -114,13 +114,13 @@ ip_prefix_is_valid() { } ip_get_network() { - inetcalc -n $@ && return ${EXIT_OK} || return ${EXIT_ERROR} + inetcalc -n "$@" && return ${EXIT_OK} || return ${EXIT_ERROR} } ip_network_is_subset_of() { assert [ $# -eq 2 ] - inetcalc -s $@ && return ${EXIT_TRUE} || return ${EXIT_FALSE} + inetcalc -s "$@" && return ${EXIT_TRUE} || return ${EXIT_FALSE} } ip_address_add() { diff --git a/src/functions/functions.ip-tunnel b/src/functions/functions.ip-tunnel index 0e1115b..cb25edd 100644 --- a/src/functions/functions.ip-tunnel +++ b/src/functions/functions.ip-tunnel @@ -37,24 +37,24 @@ ip_tunnel_add() { while [ $# -gt 0 ]; do case "${1}" in --mode=*) - mode="$(cli_get_val ${1})" + mode="$(cli_get_val "${1}")" ;; --ttl=*) - ttl="$(cli_get_val ${1})" + ttl="$(cli_get_val "${1}")" ;; --remote-address=*) - remote_address="$(cli_get_val ${1})" + remote_address="$(cli_get_val "${1}")" ;; --local-address=*) - local_address="$(cli_get_val ${1})" + local_address="$(cli_get_val "${1}")" ;; # Keys for VTI --ikey=*) - ikey="$(cli_get_val ${1})" + ikey="$(cli_get_val "${1}")" ;; --okey=*) - okey="$(cli_get_val ${1})" + okey="$(cli_get_val "${1}")" ;; esac shift diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 7283836..038ed87 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -65,10 +65,10 @@ cli_ipsec() { case "${action}" in connection) - cli_ipsec_connection $@ + cli_ipsec_connection "$@" ;; pool) - cli_ipsec_pool $@ + cli_ipsec_pool "$@" ;; *) error "Unrecognized argument: ${action}" @@ -86,7 +86,7 @@ cli_ipsec_connection() { case "${key}" in authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|pool|remote|security_policy|start_action|up) - ipsec_connection_${key} ${connection} $@ + ipsec_connection_${key} ${connection} "$@" ;; show) cli_ipsec_connection_show "${connection}" @@ -103,10 +103,10 @@ cli_ipsec_connection() { case "${action}" in new) - ipsec_connection_new $@ + ipsec_connection_new "$@" ;; destroy) - cli_ipsec_connection_destroy $@ + cli_ipsec_connection_destroy "$@" ;; ""|*) if [ -n "${action}" ]; then @@ -127,7 +127,7 @@ cli_ipsec_pool() { case "${key}" in dns_server|network) - ipsec_pool_${key} ${pool} $@ + ipsec_pool_${key} ${pool} "$@" ;; show) cli_ipsec_pool_show "${pool}" @@ -144,10 +144,10 @@ cli_ipsec_pool() { case "${action}" in new) - ipsec_pool_new $@ + ipsec_pool_new "$@" ;; destroy) - ipsec_pool_destroy $@ + ipsec_pool_destroy "$@" ;; ""|*) if [ -n "${action}" ]; then @@ -363,7 +363,7 @@ ipsec_connection_read_config() { if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS} else - list_append args $@ + list_append args "$@" fi local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings" @@ -477,10 +477,10 @@ ipsec_connection_authentication() { case ${cmd} in mode) - ipsec_connection_authentication_mode "${connection}" $@ + ipsec_connection_authentication_mode "${connection}" "$@" ;; pre-shared-key) - ipsec_connection_authentication_psk "${connection}" $@ + ipsec_connection_authentication_psk "${connection}" "$@" ;; *) log ERROR "Unrecognized argument: ${cmd}" @@ -574,13 +574,13 @@ ipsec_connection_dpd() { case ${cmd} in action) - ipsec_connection_dpd_action "${connection}" $@ + ipsec_connection_dpd_action "${connection}" "$@" ;; delay) - ipsec_connection_dpd_delay "${connection}" $@ + ipsec_connection_dpd_delay "${connection}" "$@" ;; timeout) - ipsec_connection_dpd_timeout "${connection}" $@ + ipsec_connection_dpd_timeout "${connection}" "$@" ;; *) log ERROR "Unrecognized argument: ${cmd}" @@ -621,7 +621,7 @@ ipsec_connection_dpd_delay() { local value=$@ if ! isinteger value; then - value=$(parse_time $@) + value=$(parse_time "$@") if [ ! $? -eq 0 ]; then log ERROR "Parsing the passed time was not sucessful please check the passed values." return ${EXIT_ERROR} @@ -653,7 +653,7 @@ ipsec_connection_dpd_timeout() { local value=$@ if ! isinteger value; then - value=$(parse_time $@) + value=$(parse_time "$@") if [ ! $? -eq 0 ]; then log ERROR "Parsing the passed time was not sucessful please check the passed values." return ${EXIT_ERROR} @@ -686,13 +686,13 @@ ipsec_connection_local() { case ${cmd} in address) - ipsec_connection_local_address "${connection}" $@ + ipsec_connection_local_address "${connection}" "$@" ;; id) - ipsec_connection_id "${connection}" "LOCAL" $@ + ipsec_connection_id "${connection}" "LOCAL" "$@" ;; prefix) - ipsec_connection_prefix "${connection}" "LOCAL" $@ + ipsec_connection_prefix "${connection}" "LOCAL" "$@" ;; *) log ERROR "Unrecognized argument: ${cmd}" @@ -1003,11 +1003,11 @@ ipsec_connection_remote() { case ${cmd} in id) - ipsec_connection_id "${connection}" "REMOTE" $@ + ipsec_connection_id "${connection}" "REMOTE" "$@" ;; prefix) - ipsec_connection_prefix "${connection}" "REMOTE" $@ + ipsec_connection_prefix "${connection}" "REMOTE" "$@" ;; *) log ERROR "Unrecognized argument: ${cmd}" @@ -1030,7 +1030,7 @@ ipsec_connection_inactivity_timeout() { local value=$@ if ! isinteger value; then - value=$(parse_time $@) + value=$(parse_time "$@") if [ ! $? -eq 0 ]; then log ERROR "Parsing the passed time was not sucessful please check the passed values." return ${EXIT_ERROR} @@ -1195,7 +1195,7 @@ ipsec_connection_new() { # Function that deletes based on the passed parameters one ore more vpn security policies ipsec_connection_destroy() { local connection - for connection in $@; do + for connection in "$@"; do if ! ipsec_connection_exists "${connection}"; then log ERROR "The VPN IPsec connection ${connection} does not exist." continue @@ -1598,7 +1598,7 @@ ipsec_pool_read_config() { if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then list_append args ${IPSEC_POOL_CONFIG_SETTINGS} else - list_append args $@ + list_append args "$@" fi local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings" @@ -1679,7 +1679,7 @@ ipsec_pool_new() { # one ore more vpn ipsec pools ipsec_pool_destroy() { local pool - for pool in $@; do + for pool in "$@"; do if ! ipsec_pool_exists "${pool}"; then log ERROR "The VPN IPsec pool ${pool} does not exist." continue diff --git a/src/functions/functions.iptables b/src/functions/functions.iptables index 86627a4..821eb60 100644 --- a/src/functions/functions.iptables +++ b/src/functions/functions.iptables @@ -116,7 +116,7 @@ iptables_chain_create() { shift ;; --policy=*) - policy="$(cli_get_val ${1})" + policy="$(cli_get_val "${1}")" ;; -*) log WARNING "Unrecognized argument: ${1}" @@ -369,7 +369,7 @@ iptables_dump() { while [ $# -gt 0 ]; do case "${1}" in --log-facility=*) - log_facility="$(cli_get_val ${1})" + log_facility="$(cli_get_val "${1}")" ;; *) log WARNING "Unrecognized argument: ${1}" @@ -441,11 +441,11 @@ IPTABLES_MULTIPORT=1 IPTABLES_PORTRANGE=2 _iptables_port_range() { - grep -q ":" <<< $@ + grep -q ":" <<< "$@" } _iptables_port_multiport() { - grep -q "," <<< $@ + grep -q "," <<< "$@" } _iptables_port() { @@ -461,7 +461,7 @@ _iptables_port() { iptables_source_port() { [ -z "$@" ] && return local type - type=$(_iptables_port $@) + type=$(_iptables_port "$@") if [ "$type" = "$IPTABLES_MULTIPORT" ]; then echo "-m multiport --source-ports $@" else @@ -472,7 +472,7 @@ iptables_source_port() { iptables_destination_port() { [ -z "$@" ] && return local type - type=$(_iptables_port $@) + type=$(_iptables_port "$@") if [ "$type" = "$IPTABLES_MULTIPORT" ]; then echo "-m multiport --destination-ports $@" else diff --git a/src/functions/functions.ipv4 b/src/functions/functions.ipv4 index e893f5e..d19be51 100644 --- a/src/functions/functions.ipv4 +++ b/src/functions/functions.ipv4 @@ -260,11 +260,11 @@ ipv4_netmask2prefix() { } ipv4_get_network() { - ip_get_network $@ + ip_get_network "$@" } ipv4_get_broadcast() { - inetcalc -4 -b $@ && return ${EXIT_OK} || return ${EXIT_ERROR} + inetcalc -4 -b "$@" && return ${EXIT_OK} || return ${EXIT_ERROR} } ipv4_encode() { @@ -315,15 +315,15 @@ ipv4_addr_gt() { } ipv4_addr_ge() { - ipv4_addr_eq $@ || ipv4_addr_gt $@ + ipv4_addr_eq "$@" || ipv4_addr_gt "$@" } ipv4_addr_lt() { - ! ipv4_addr_eq $@ && ! ipv4_addr_gt $@ + ! ipv4_addr_eq "$@" && ! ipv4_addr_gt "$@" } ipv4_addr_le() { - ipv4_addr_eq $@ || ! ipv4_addr_gt $@ + ipv4_addr_eq "$@" || ! ipv4_addr_gt "$@" } ipv4_range() { diff --git a/src/functions/functions.ipv6 b/src/functions/functions.ipv6 index e160fb3..50c2b9e 100644 --- a/src/functions/functions.ipv6 +++ b/src/functions/functions.ipv6 @@ -64,7 +64,7 @@ ipv6_device_forwarding_enable() { accept_ra=2 ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" sysctl_set "net.ipv6.conf.${device}.forwarding" 1 @@ -191,7 +191,7 @@ ipv6_address_add() { wait_for_dad="false" ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" local cmd="ip addr add ${address} dev ${device} scope ${scope}" @@ -280,7 +280,7 @@ ipv6_address_change_lifetime() { valid_lft="$(cli_get_val "${arg}")" ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" local cmd="ip -6 addr change ${address} dev ${device} scope global" @@ -385,7 +385,7 @@ ipv6_device_get_addresses() { scope="$(cli_get_val "${arg}")" ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" local cmd="ip -o addr show dev ${device}" if isset scope; then @@ -411,7 +411,7 @@ ipv6_device_get_addresses() { } ipv6_format() { - inetcalc -6 -f $@ + inetcalc -6 -f "$@" } ipv6_addr_eq() { @@ -435,17 +435,17 @@ ipv6_addr_gt() { } ipv6_addr_ge() { - ipv6_addr_eq $@ || ipv6_addr_gt $@ + ipv6_addr_eq "$@" || ipv6_addr_gt "$@" } ipv6_addr_lt() { - ! ipv6_addr_eq $@ && ! ipv6_addr_gt $@ + ! ipv6_addr_eq "$@" && ! ipv6_addr_gt "$@" } ipv6_addr_le() { - ipv6_addr_eq $@ || ! ipv6_addr_gt $@ + ipv6_addr_eq "$@" || ! ipv6_addr_gt "$@" } ipv6_get_network() { - ip_get_network $@ + ip_get_network "$@" } diff --git a/src/functions/functions.list b/src/functions/functions.list index 7e96cdf..9ca13b9 100644 --- a/src/functions/functions.list +++ b/src/functions/functions.list @@ -29,7 +29,7 @@ list_append() { shift local arg - for arg in $@; do + for arg in "$@"; do list_append_one "${list}" "${arg}" done } @@ -60,7 +60,7 @@ list_append_unique() { local ret=${EXIT_ERROR} local arg - for arg in $@; do + for arg in "$@"; do if ! list_match ${arg} ${!list}; then list_append_one ${list} "${arg}" ret=${EXIT_OK} @@ -83,7 +83,7 @@ list_remove() { local _list k for k in ${!list}; do - if list_match ${k} $@; then + if list_match ${k} "$@"; then ret=${EXIT_OK} continue fi @@ -98,7 +98,7 @@ list_remove() { list_sort() { local i - for i in $@; do + for i in "$@"; do print "${i}" done | sort | tr '\n' ' ' print @@ -106,7 +106,7 @@ list_sort() { list_unique() { local items item - for item in $@; do + for item in "$@"; do # Check if the item has already been processed. list_match "${item}" ${items} && continue @@ -120,7 +120,7 @@ list_match() { shift local i - for i in $@; do + for i in "$@"; do [ "${match}" = "${i}" ] && return ${EXIT_OK} done @@ -137,7 +137,7 @@ list_length() { local length=0 local i - for i in $@; do + for i in "$@"; do length=$(( ${length} + 1 )) done @@ -152,7 +152,7 @@ list_count() { local counter=0 local arg - for arg in $@; do + for arg in "$@"; do if [ "${arg}" = "${what}" ]; then counter=$(( ${counter} + 1 )) fi @@ -177,7 +177,7 @@ list_join() { list_reverse() { local reversed arg - for arg in $@; do + for arg in "$@"; do reversed="${arg} ${reversed}" done @@ -187,7 +187,7 @@ list_reverse() { list_head() { local arg - for arg in $@; do + for arg in "$@"; do print "${arg}" return ${EXIT_OK} done diff --git a/src/functions/functions.modem b/src/functions/functions.modem index 90def3f..a2b01ca 100644 --- a/src/functions/functions.modem +++ b/src/functions/functions.modem @@ -34,10 +34,10 @@ modem_chat() { while [ $# -gt 0 ]; do case "${1}" in --timeout=*) - timeout=$(cli_get_val ${1}) + timeout=$(cli_get_val "${1}") ;; --answer=*) - answer=$(cli_get_val ${1}) + answer=$(cli_get_val "${1}") ;; --quiet) quiet="true" @@ -204,7 +204,7 @@ modem_sim_unlocked() { } modem_sim_locked() { - modem_sim_unlocked $@ && return ${EXIT_FALSE} || return ${EXIT_TRUE} + modem_sim_unlocked "$@" && return ${EXIT_FALSE} || return ${EXIT_TRUE} } modem_sim_unlock() { diff --git a/src/functions/functions.ports b/src/functions/functions.ports index af3f5f0..cacc10c 100644 --- a/src/functions/functions.ports +++ b/src/functions/functions.ports @@ -149,7 +149,7 @@ port_is_attached() { } port_is_up() { - device_is_up $@ + device_is_up "$@" } port_new() { @@ -161,7 +161,7 @@ port_new() { return ${EXIT_ERROR} fi - hook_exec port "${hook}" new $@ + hook_exec port "${hook}" new "$@" } port_destroy() { @@ -203,7 +203,7 @@ port_destroy() { } port_create() { - port_cmd "create" $@ + port_cmd "create" "$@" } port_remove() { @@ -234,19 +234,19 @@ port_restart() { } port_edit() { - port_cmd edit $@ + port_cmd edit "$@" } port_up() { - port_cmd up $@ + port_cmd up "$@" } port_down() { - port_cmd down $@ + port_cmd down "$@" } port_status() { - port_cmd status $@ + port_cmd status "$@" } port_cmd() { @@ -265,7 +265,7 @@ port_cmd() { return ${EXIT_ERROR} fi - hook_exec port ${hook} ${cmd} ${port} $@ + hook_exec port ${hook} ${cmd} ${port} "$@" } ports_get() { @@ -404,7 +404,7 @@ ports_lowest_address() { } port_identify() { - device_identify $@ + device_identify "$@" } port_get_color() { diff --git a/src/functions/functions.ppp b/src/functions/functions.ppp index 0840467..b114585 100644 --- a/src/functions/functions.ppp +++ b/src/functions/functions.ppp @@ -399,18 +399,18 @@ pppd_write_config() { while [ $# -gt 0 ]; do case "${1}" in --auth=*) - auth=$(cli_get_val ${1}) + auth=$(cli_get_val "${1}") ;; --baudrate=*) - baudrate=$(cli_get_val ${1}) + baudrate=$(cli_get_val "${1}") assert isoneof baudrate ${SERIAL_BAUDRATES} ;; --connect-command=*) - connect_cmd=$(cli_get_val ${1}) + connect_cmd=$(cli_get_val "${1}") ;; # Enable or disable the use of the default asyncmap. --default-asyncmap=*) - value=$(cli_get_val ${1}) + value=$(cli_get_val "${1}") if enabled value; then default_asyncmap="true" else @@ -419,15 +419,15 @@ pppd_write_config() { ;; # The name of the created ppp interface. --interface=*) - interface=$(cli_get_val ${1}) + interface=$(cli_get_val "${1}") ;; # IPv6 --ipv6=*) - ipv6="$(cli_get_val ${1})" + ipv6="$(cli_get_val "${1}")" ;; # LCP echo failure. --lcr-echo-failure=*) - lcr_echo_failure=$(cli_get_val ${1}) + lcr_echo_failure=$(cli_get_val "${1}") if ! isinteger ${lcr_echo_failure}; then error "--lcr-echo-failure= requires a number" @@ -436,7 +436,7 @@ pppd_write_config() { ;; # LCP echo interval. --lcr-echo-interval=*) - lcr_echo_interval=$(cli_get_val ${1}) + lcr_echo_interval=$(cli_get_val "${1}") if ! isinteger ${lcr_echo_failure}; then error "--lcr-echo-interval= requires a number" @@ -445,23 +445,23 @@ pppd_write_config() { ;; # Maximum Transmission Unit --mtu=*) - mtu=$(cli_get_val ${1}) + mtu=$(cli_get_val "${1}") ;; # Maximum Receive Unit --mru=*) - mru=$(cli_get_val ${1}) + mru=$(cli_get_val "${1}") ;; --password=*) - password=$(cli_get_val ${1}) + password=$(cli_get_val "${1}") ;; --plugin=*) - plugin=$(cli_get_val ${1}) + plugin=$(cli_get_val "${1}") ;; --plugin-options=*) - plugin_options=$(cli_get_val ${1}) + plugin_options=$(cli_get_val "${1}") ;; --pty=*) - pty=$(cli_get_val ${1}) + pty=$(cli_get_val "${1}") ;; # Refused authentication methods --refuse=*) @@ -470,13 +470,13 @@ pppd_write_config() { ;; # Sets if the modem is a serial device. --serial=*) - serial=$(cli_get_val ${1}) + serial=$(cli_get_val "${1}") ;; --serial-device=*) - serial_device=$(cli_get_val ${1}) + serial_device=$(cli_get_val "${1}") ;; --username=*) - username=$(cli_get_val ${1}) + username=$(cli_get_val "${1}") ;; *) log WARNING "Unhandled argument: ${1}" diff --git a/src/functions/functions.pppoe-server b/src/functions/functions.pppoe-server index 2db7433..5d65d24 100644 --- a/src/functions/functions.pppoe-server +++ b/src/functions/functions.pppoe-server @@ -70,30 +70,30 @@ pppoe_server_options() { while [ $# -gt 0 ]; do case "${1}" in --auth=*) - auth=$(cli_get_val ${1}) + auth=$(cli_get_val "${1}") ;; --default-asyncmap=*) - default_asyncmap=$(cli_get_val ${1}) + default_asyncmap=$(cli_get_val "${1}") ;; --disable-ipv6) ipv6="false" ;; --dns-servers=*) - dns_servers="$(cli_get_val ${1})" + dns_servers="$(cli_get_val "${1}")" ;; --lcp-echo-failure=*) - lcp_echo_failure=$(cli_get_val ${1}) + lcp_echo_failure=$(cli_get_val "${1}") assert isinteger ${lcp_echo_failure} ;; --lcp-echo-interval=*) - lcp_echo_interval=$(cli_get_val ${1}) + lcp_echo_interval=$(cli_get_val "${1}") assert isinteger ${lcp_echo_interval} ;; --proxyarp=*) - proxyarp=$(cli_get_val ${1}) + proxyarp=$(cli_get_val "${1}") ;; --require-auth=*) - required_auths="${required_auths} $(cli_get_val ${1})" + required_auths="${required_auths} $(cli_get_val "${1}")" ;; esac shift diff --git a/src/functions/functions.route b/src/functions/functions.route index 6a2c1fa..7ca4f59 100644 --- a/src/functions/functions.route +++ b/src/functions/functions.route @@ -23,7 +23,7 @@ # cli_route() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-route exit ${EXIT_OK} fi @@ -33,7 +33,7 @@ cli_route() { case "${action}" in static) - cli_route_static $@ + cli_route_static "$@" ;; *) error "Unrecognized action: ${action}" @@ -47,7 +47,7 @@ cli_route() { } cli_route_static() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-route-static exit ${EXIT_OK} fi @@ -58,20 +58,20 @@ cli_route_static() { case "${action}" in # Add a new route. add) - route_add $@ + route_add "$@" ;; # Remove an existing route. remove) - route_remove $@ + route_remove "$@" ;; # List all routes. list) - route_list $@ + route_list "$@" return ${EXIT_OK} ;; # Reload all routes reload) - route_apply $@ + route_apply "$@" ;; *) error "Unrecognized action: ${action}" @@ -93,7 +93,7 @@ route_add() { while [ $# -gt 0 ]; do case "${1}" in --gateway=*) - gateway=$(cli_get_val ${1}) + gateway=$(cli_get_val "${1}") ;; --unreachable) unreachable="true" @@ -105,7 +105,7 @@ route_add() { blackhole="true" ;; --mtu=*) - mtu=$(cli_get_val ${1}) + mtu=$(cli_get_val "${1}") ;; *) if isset network; then @@ -217,7 +217,7 @@ route_remove() { local _network local error=${EXIT_OK} - for _network in $@; do + for _network in "$@"; do # Validate input if ! ip_net_is_valid ${_network} && ! ip_is_valid ${_network}; then error "Invalid IP address or network: ${_network}" @@ -260,7 +260,7 @@ route_list() { while [ $# -gt 0 ]; do case "${1}" in --protocol=*) - protocol=$(cli_get_val ${1}) + protocol=$(cli_get_val "${1}") ;; *) warning "Unrecognized argument: ${1}" @@ -335,25 +335,25 @@ route_parse_line() { while read arg; do case "${arg}" in network=*) - network=$(cli_get_val ${arg}) + network=$(cli_get_val "${arg}") ;; gateway=*) - gateway=$(cli_get_val ${arg}) + gateway=$(cli_get_val "${arg}") ;; unreachable=*) - unreachable=$(cli_get_val ${arg}) + unreachable=$(cli_get_val "${arg}") ;; prohibit=*) - prohibit=$(cli_get_val ${arg}) + prohibit=$(cli_get_val "${arg}") ;; blackhole=*) - blackhole=$(cli_get_val ${arg}) + blackhole=$(cli_get_val "${arg}") ;; mtu=*) - mtu=$(cli_get_val ${arg}) + mtu=$(cli_get_val "${arg}") ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" ### Check if all values are correctly set. @@ -443,19 +443,19 @@ route_entry_add() { while [ $# -gt 0 ]; do case "${1}" in --gateway=*) - gateway=$(cli_get_val ${1}) + gateway=$(cli_get_val "${1}") ;; --table=*) - table=$(cli_get_val ${1}) + table=$(cli_get_val "${1}") ;; --type=*) - type=$(cli_get_val ${1}) + type=$(cli_get_val "${1}") ;; --proto=*) - proto=$(cli_get_val ${1}) + proto=$(cli_get_val "${1}") ;; --mtu=*) - mtu=$(cli_get_val ${1}) + mtu=$(cli_get_val "${1}") ;; *) if isset network; then @@ -574,7 +574,7 @@ route_table_flush() { while [ $# -gt 0 ]; do case "${1}" in --protocol=*) - protocol=$(cli_get_val ${1}) + protocol=$(cli_get_val "${1}") ;; *) table="${1}" @@ -621,7 +621,7 @@ route_table_exists() { while [ $# -gt 0 ]; do case "${1}" in --id=*) - _id=$(cli_get_val ${1}) + _id=$(cli_get_val "${1}") ;; *) _table=${1} @@ -653,13 +653,13 @@ route_rule_add() { while [ $# -gt 0 ]; do case "${1}" in --lookup=*) - lookup=$(cli_get_val ${1}) + lookup=$(cli_get_val "${1}") ;; --priority=*) - priority=$(cli_get_val ${1}) + priority=$(cli_get_val "${1}") ;; --protocol=*) - protocols=$(cli_get_val ${1}) + protocols=$(cli_get_val "${1}") assert isoneof protocols ${IP_SUPPORTED_PROTOCOLS} ;; @@ -717,16 +717,16 @@ route_rule_exists() { while [ $# -gt 0 ]; do case "${1}" in --from=*) - from=$(cli_get_val ${1}) + from=$(cli_get_val "${1}") ;; --lookup=*) - lookup=$(cli_get_val ${1}) + lookup=$(cli_get_val "${1}") ;; --priority=*) - prio=$(cli_get_val ${1}) + prio=$(cli_get_val "${1}") ;; --protocol=*) - proto=$(cli_get_val ${1}) + proto=$(cli_get_val "${1}") ;; *) warning "Unrecognized argument: ${1}" diff --git a/src/functions/functions.settings b/src/functions/functions.settings index a7d9464..becf3f0 100644 --- a/src/functions/functions.settings +++ b/src/functions/functions.settings @@ -37,7 +37,7 @@ settings_read() { list_append valid_keys "${arg}" ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" if [ -d "${file}" ]; then error "Not a configuration file: '${file}'" @@ -58,7 +58,7 @@ settings_read() { list_match ${key} ${valid_keys} || continue fi - val=$(cli_get_val ${line}) + val=$(cli_get_val "${line}") val=$(settings_strip ${val}) # Assign variable. @@ -99,7 +99,7 @@ settings_read_array() { fi fi - val=$(cli_get_val ${line}) + val=$(cli_get_val "${line}") val=$(settings_strip ${val}) # Assign variable. @@ -146,7 +146,7 @@ settings_write() { ;; esac shift - done <<< "$(args $@)" + done <<< "$(args "$@")" # Check if all values to be written are sane if isset check_func && ! settings_check "${check_func}"; then @@ -159,7 +159,7 @@ settings_write() { > ${settings_file} local param - for param in $(list_sort $@); do + for param in $(list_sort "$@"); do echo "${param}=\"${!param}\"" >> ${settings_file} done } @@ -179,7 +179,7 @@ settings_remove() { settings_print() { local param - for param in $(list_sort $@); do + for param in $(list_sort "$@"); do printf "%-32s = %s\n" "${param}" "${!param}" done } @@ -219,8 +219,8 @@ settings_set() { while [ $# -gt 0 ]; do case "${1}" in *=*) - local key=$(cli_get_key ${1}) - local val=$(cli_get_val ${1}) + local key=$(cli_get_key "${1}") + local val=$(cli_get_val "${1}") log INFO "Setting configuration option '${key}=${val}'". @@ -258,8 +258,8 @@ network_settings_set() { case "${arg}" in *=*) - local key=$(cli_get_key ${arg}) - local val=$(cli_get_val ${arg}) + local key=$(cli_get_key "${arg}") + local val=$(cli_get_val "${arg}") case "${key}" in DNS_RANDOMIZE|DNS_SEARCH_DOMAIN|DNS_USE_LOCAL_RESOLVER) diff --git a/src/functions/functions.util b/src/functions/functions.util index 687d008..24e3e66 100644 --- a/src/functions/functions.util +++ b/src/functions/functions.util @@ -134,7 +134,7 @@ parse_time() { local ret=0 local arg - for arg in $@; do + for arg in "$@"; do local unit case "${arg}" in @@ -495,7 +495,7 @@ cmd() { } cmd_quiet() { - cmd $@ &>/dev/null + cmd "$@" &>/dev/null } cmd_exec() { @@ -515,7 +515,7 @@ cmd_not_implemented() { # Executes the given command in background cmd_background() { - cmd_quiet $@ & + cmd_quiet "$@" & } # Prints the PID of the process that was started last @@ -531,7 +531,7 @@ cmd_background_result() { # Increase security of the read command read() { - builtin read -r $@ + builtin read -r "$@" } seq() { @@ -557,7 +557,7 @@ count() { } which() { - type -P $@ + type -P "$@" } # Prints the number of seconds since epoch. diff --git a/src/functions/functions.vpn b/src/functions/functions.vpn index 6d62f17..c004397 100644 --- a/src/functions/functions.vpn +++ b/src/functions/functions.vpn @@ -25,10 +25,10 @@ cli_vpn() { case "${action}" in ipsec) - cli_ipsec $@ + cli_ipsec "$@" ;; security-policies) - cli_vpn_security_policies $@ + cli_vpn_security_policies "$@" ;; *) error "Unrecognized argument: ${action}" diff --git a/src/functions/functions.vpn-security-policies b/src/functions/functions.vpn-security-policies index cdd4e83..0f7b49e 100644 --- a/src/functions/functions.vpn-security-policies +++ b/src/functions/functions.vpn-security-policies @@ -269,13 +269,13 @@ cli_vpn_security_policies() { case "${key}" in cipher|compression|integrity|lifetime|pfs|show) - vpn_security_policies_${key} ${security_policy} $@ + vpn_security_policies_${key} ${security_policy} "$@" ;; group-type) - vpn_security_policies_group_type ${security_policy} $@ + vpn_security_policies_group_type ${security_policy} "$@" ;; key-exchange) - vpn_security_policies_key_exchange ${security_policy} $@ + vpn_security_policies_key_exchange ${security_policy} "$@" ;; *) error "Unrecognized argument: ${key}" @@ -288,10 +288,10 @@ cli_vpn_security_policies() { case "${action}" in new) - vpn_security_policies_new $@ + vpn_security_policies_new "$@" ;; destroy) - vpn_security_policies_destroy $@ + vpn_security_policies_destroy "$@" ;; ""|*) if [ -n "${action}" ]; then @@ -419,7 +419,7 @@ vpn_security_policies_read_config() { if [ $# -eq 0 ] && [ -n "${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}" ]; then list_append args ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS} else - list_append args $@ + list_append args "$@" fi local path="$(vpn_security_policies_path ${name})" @@ -793,7 +793,7 @@ vpn_security_policies_lifetime(){ fi if ! isinteger value; then - value=$(parse_time $@) + value=$(parse_time "$@") if [ ! $? -eq 0 ]; then log ERROR "Parsing the passed time was not sucessful please check the passed values." return ${EXIT_ERROR} @@ -892,7 +892,7 @@ vpn_security_policies_new() { # Function that deletes based on the passed parameters one ore more vpn security policies vpn_security_policies_destroy() { local name - for name in $@; do + for name in "$@"; do if ! vpn_security_policy_exists ${name}; then log ERROR "The vpn security policy ${name} does not exist." continue diff --git a/src/functions/functions.wireless b/src/functions/functions.wireless index 581bdbf..3835f45 100644 --- a/src/functions/functions.wireless +++ b/src/functions/functions.wireless @@ -37,14 +37,14 @@ wireless_create() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - address=$(cli_get_val ${1}) + address=$(cli_get_val "${1}") ;; --phy=*) - phy=$(cli_get_val ${1}) + phy=$(cli_get_val "${1}") phy=$(phy_get ${phy}) ;; --type=*) - type=$(cli_get_val ${1}) + type=$(cli_get_val "${1}") # ap --> __ap [ "${type}" = "ap" ] && type="__ap" @@ -274,13 +274,13 @@ wireless_ibss_join() { while [ $# -gt 0 ]; do case "${1}" in --bssid=*) - bssid="$(cli_get_val ${1})" + bssid="$(cli_get_val "${1}")" ;; --essid=*) - essid="$(cli_get_val ${1})" + essid="$(cli_get_val "${1}")" ;; --channel=*) - local channel="$(cli_get_val ${1})" + local channel="$(cli_get_val "${1}")" # Save the frequency of the channel instead # of the channel itself. diff --git a/src/functions/functions.wpa_supplicant b/src/functions/functions.wpa_supplicant index f8aed22..e7f3677 100644 --- a/src/functions/functions.wpa_supplicant +++ b/src/functions/functions.wpa_supplicant @@ -36,19 +36,19 @@ wpa_supplicant_config_write() { for arg in "$@"; do case "${arg}" in --ap-scan=*) - ap_scan=$(cli_get_val ${arg}) + ap_scan=$(cli_get_val "${arg}") ;; --mode=*) - mode=$(cli_get_val ${arg}) + mode=$(cli_get_val "${arg}") # Empty signals no encryption. isset mode || mode="NONE" ;; --ssid=*) - ssid=$(cli_get_val ${arg}) + ssid=$(cli_get_val "${arg}") ;; --key=*) - key=$(cli_get_val ${arg}) + key=$(cli_get_val "${arg}") ;; *) error "Unrecognized argument: ${arg}" diff --git a/src/functions/functions.zone b/src/functions/functions.zone index 1eb492f..52f8ee1 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -210,7 +210,7 @@ zone_cmd() { local hook="$(zone_get_hook ${zone})" assert isset hook - hook_exec zone "${hook}" "${cmd}" "${zone}" $@ + hook_exec zone "${hook}" "${cmd}" "${zone}" "$@" } zone_new() { @@ -238,7 +238,7 @@ zone_new() { # Create directories for configs and ports mkdir -p $(zone_dir ${zone})/{configs,ports} - hook_zone_exec "${hook}" "new" "${zone}" $@ + hook_zone_exec "${hook}" "new" "${zone}" "$@" local ret=$? # Maybe the zone new hook did not exit correctly. @@ -281,7 +281,7 @@ zone_edit() { return ${EXIT_ERROR} fi - hook_zone_exec ${hook} edit ${zone} $@ + hook_zone_exec ${hook} edit ${zone} "$@" } zone_rename() { @@ -388,7 +388,7 @@ zone_up() { zone_db ${zone} starting - hook_zone_exec ${hook} up ${zone} $@ + hook_zone_exec ${hook} up ${zone} "$@" zone_db ${zone} started @@ -418,7 +418,7 @@ zone_down() { zone_db ${zone} stopping - hook_zone_exec ${hook} down ${zone} $@ + hook_zone_exec ${hook} down ${zone} "$@" zone_db ${zone} stopped @@ -475,7 +475,7 @@ zone_identify() { local port for port in $(zone_get_ports "${zone}"); do # Identify all the ports - port_identify "${port}" --background $@ + port_identify "${port}" --background "$@" # Save the PIDs of the subprocesses list_append pids "$(cmd_background_get_pid)" @@ -754,7 +754,7 @@ zone_show() { zones_show() { local zone - for zone in $(zones_get $@); do + for zone in $(zones_get "$@"); do zone_show ${zone} done } @@ -994,23 +994,23 @@ zone_port_cmd() { assert isset hook # Dispatch command to hook - hook_zone_exec "${hook}" "${cmd}" "${zone}" "${port}" $@ + hook_zone_exec "${hook}" "${cmd}" "${zone}" "${port}" "$@" } zone_port_create() { - zone_port_cmd "port_create" $@ + zone_port_cmd "port_create" "$@" } zone_port_remove() { - zone_port_cmd "port_remove" $@ + zone_port_cmd "port_remove" "$@" } zone_port_up() { - zone_port_cmd "port_up" $@ + zone_port_cmd "port_up" "$@" } zone_port_down() { - zone_port_cmd "port_down" $@ + zone_port_cmd "port_down" "$@" } # The next two functions automagically bring up and down @@ -1051,7 +1051,7 @@ zone_port_stop() { } zone_port_status() { - zone_port_cmd "port_status" $@ + zone_port_cmd "port_status" "$@" } zone_ports_cmd() { @@ -1067,28 +1067,28 @@ zone_ports_cmd() { local port for port in $(zone_get_ports ${zone}); do - hook_zone_exec "${hook}" "${cmd}" "${zone}" "${port}" $@ + hook_zone_exec "${hook}" "${cmd}" "${zone}" "${port}" "$@" done } zone_ports_create() { - zone_ports_cmd "port_create" $@ + zone_ports_cmd "port_create" "$@" } zone_ports_remove() { - zone_ports_cmd "port_remove" $@ + zone_ports_cmd "port_remove" "$@" } zone_ports_up() { - zone_ports_cmd "port_up" $@ + zone_ports_cmd "port_up" "$@" } zone_ports_down() { - zone_ports_cmd "port_down" $@ + zone_ports_cmd "port_down" "$@" } zone_ports_status() { - zone_ports_cmd "port_status" $@ + zone_ports_cmd "port_status" "$@" } zone_configs_cmd() { @@ -1105,20 +1105,20 @@ zone_configs_cmd() { local config_hook="$(zone_config_get_hook "${zone}" "${config}")" assert isset config_hook - hook_config_exec "${config_hook}" "${cmd}" "${zone}" "${config}" $@ + hook_config_exec "${config_hook}" "${cmd}" "${zone}" "${config}" "$@" done } zone_configs_up() { - zone_configs_cmd "up" $@ + zone_configs_cmd "up" "$@" } zone_configs_down() { - zone_configs_cmd "down" $@ + zone_configs_cmd "down" "$@" } zone_configs_status() { - zone_configs_cmd "status" $@ + zone_configs_cmd "status" "$@" } zone_configs_list() { @@ -1272,7 +1272,7 @@ zone_config_get_hook_from_id() { } zone_has_ip() { - device_has_ip $@ + device_has_ip "$@" } zone_db() { @@ -1294,7 +1294,7 @@ zone_is_up() { } zone_is_down() { - ! zone_is_up $@ + ! zone_is_up "$@" } zone_get_supported_port_hooks() { @@ -1326,7 +1326,7 @@ zone_settings_read() { if [ $# -eq 0 ] && [ -n "${HOOK_SETTINGS}" ]; then list_append args ${HOOK_SETTINGS} else - list_append args $@ + list_append args "$@" fi # Save the HOOK variable. @@ -1395,7 +1395,7 @@ zone_config_settings_read() { if [ $# -eq 0 ] && [ -n "${HOOK_CONFIG_SETTINGS}" ]; then list_append args ${HOOK_CONFIG_SETTINGS} else - list_append args $@ + list_append args "$@" fi local path="$(zone_dir "${zone}")/configs/${config}" @@ -1453,7 +1453,7 @@ zone_port_settings_read() { if [ $# -eq 0 ] && [ -n "${HOOK_PORT_SETTINGS}" ]; then list_append args ${HOOK_PORT_SETTINGS} else - list_append args $@ + list_append args "$@" fi local path="$(zone_dir "${zone}")/ports/${port}" diff --git a/src/header-config b/src/header-config index 6341a22..ec85a70 100644 --- a/src/header-config +++ b/src/header-config @@ -55,7 +55,7 @@ hook_edit() { return ${EXIT_ERROR} fi - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then # Return an error if the parsing of the cmd line fails return ${EXIT_ERROR} fi diff --git a/src/header-port b/src/header-port index 238749e..9d1c1df 100644 --- a/src/header-port +++ b/src/header-port @@ -51,7 +51,7 @@ hook_default_edit() { port_settings_read "${port}" ${HOOK_SETTINGS} - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then return ${EXIT_ERROR} fi @@ -61,7 +61,7 @@ hook_default_edit() { } hook_edit() { - hook_default_edit $@ + hook_default_edit "$@" } # Returns a list of all children of this port @@ -116,7 +116,7 @@ hook_default_up() { } hook_up() { - hook_default_up $@ + hook_default_up "$@" } hook_default_down() { @@ -135,5 +135,5 @@ hook_default_down() { } hook_down() { - hook_default_down $@ + hook_default_down "$@" } diff --git a/src/header-zone b/src/header-zone index 189fbc3..ead4a32 100644 --- a/src/header-zone +++ b/src/header-zone @@ -34,7 +34,7 @@ hook_new() { assert isset zone shift - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then return ${EXIT_ERROR} fi @@ -56,7 +56,7 @@ hook_edit() { return ${EXIT_ERROR} fi - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then return ${EXIT_ERROR} fi @@ -112,7 +112,7 @@ hook_port() { local ret case "${action}" in add|create|edit|rem|show) - hook_port_${action} "${zone}" $@ + hook_port_${action} "${zone}" "$@" ret=$? ;; *) @@ -150,7 +150,7 @@ hook_default_port_create() { } hook_port_create() { - hook_default_port_create $@ + hook_default_port_create "$@" } hook_default_port_remove() { @@ -163,7 +163,7 @@ hook_default_port_remove() { } hook_port_remove() { - hook_default_port_remove $@ + hook_default_port_remove "$@" } hook_port_up() { diff --git a/src/hooks/configs/dhcp b/src/hooks/configs/dhcp index 7f6780b..f22507c 100644 --- a/src/hooks/configs/dhcp +++ b/src/hooks/configs/dhcp @@ -72,7 +72,7 @@ hook_new() { return ${EXIT_ERROR} fi - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then # Return an error if the parsing of the cmd line fails return ${EXIT_ERROR} fi diff --git a/src/hooks/configs/ipv4-static b/src/hooks/configs/ipv4-static index ef74991..7aea0b9 100644 --- a/src/hooks/configs/ipv4-static +++ b/src/hooks/configs/ipv4-static @@ -87,7 +87,7 @@ hook_parse_cmdline() { exit ${EXIT_CONF_ERROR} ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" if ! isset ADDRESS; then error "You need to provide an IPv4 address" @@ -115,7 +115,7 @@ hook_new() { assert zone_exists "${zone}" - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then # Return an error if the parsing of the cmd line fails return ${EXIT_ERROR} fi diff --git a/src/hooks/configs/ipv6-auto b/src/hooks/configs/ipv6-auto index 375e585..bf1003d 100644 --- a/src/hooks/configs/ipv6-auto +++ b/src/hooks/configs/ipv6-auto @@ -45,7 +45,7 @@ hook_parse_cmdline() { fi ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" } hook_new() { @@ -57,7 +57,7 @@ hook_new() { return ${EXIT_ERROR} fi - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then # Return an error if the parsing of the cmd line fails return ${EXIT_ERROR} fi diff --git a/src/hooks/configs/ipv6-static b/src/hooks/configs/ipv6-static index c41401c..273c201 100644 --- a/src/hooks/configs/ipv6-static +++ b/src/hooks/configs/ipv6-static @@ -66,7 +66,7 @@ hook_new() { local zone=${1} shift - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then # Return an error if the parsing of the cmd line fails return ${EXIT_ERROR} fi diff --git a/src/hooks/configs/pppoe-server b/src/hooks/configs/pppoe-server index b4d2538..7021be2 100644 --- a/src/hooks/configs/pppoe-server +++ b/src/hooks/configs/pppoe-server @@ -65,24 +65,24 @@ hook_parse_cmdline() { done ;; --max-sessions=*) - MAX_SESSIONS=$(cli_get_val ${1}) + MAX_SESSIONS=$(cli_get_val "${1}") if ! isinteger ${MAX_SESSIONS} || ! [ ${MAX_SESSIONS} -ge 0 ]; then error "Invalid value for '--max-session'. This value must be an integer greate or eqal zero." exit ${EXIT_ERROR} fi ;; --mtu=*) - MTU=$(cli_get_val ${1}) + MTU=$(cli_get_val "${1}") if ! mtu_is_valid "ipv4" ${MTU}; then error "Invalid value for '--mtu'. Cannot be larger then 9000 or smaller than 576" exit ${EXIT_ERROR} fi ;; --service-name=*) - SERVICE_NAME=$(cli_get_val ${1}) + SERVICE_NAME=$(cli_get_val "${1}") ;; --subnet=*) - SUBNET=$(cli_get_val ${1}) + SUBNET=$(cli_get_val "${1}") if ! ipv4_net_is_valid "${SUBNET}"; then error "Invalid IPv4 Subnet ${SUBNET}." exit ${EXIT_ERROR} @@ -105,7 +105,7 @@ hook_new() { return ${EXIT_ERROR} fi - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then # Return an error if the parsing of the cmd line fails return ${EXIT_ERROR} fi diff --git a/src/hooks/ports/batman-adv b/src/hooks/ports/batman-adv index 4f16201..b304f4f 100644 --- a/src/hooks/ports/batman-adv +++ b/src/hooks/ports/batman-adv @@ -37,10 +37,10 @@ hook_new() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - ADDRESS="$(cli_get_val ${1})" + ADDRESS="$(cli_get_val "${1}")" ;; --slaves=*) - SLAVES="$(cli_get_val ${1})" + SLAVES="$(cli_get_val "${1}")" ;; *) warning "Ignoring unknown argument '${1}'" @@ -67,13 +67,13 @@ hook_edit() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - ADDRESS="$(cli_get_val ${1})" + ADDRESS="$(cli_get_val "${1}")" ;; --add-slave=*) - SLAVES="${SLAVES} $(cli_get_val ${1})" + SLAVES="${SLAVES} $(cli_get_val "${1}")" ;; --del-slave=*) - local slave="$(cli_get_val ${1})" + local slave="$(cli_get_val "${1}")" local s slaves for s in ${SLAVES}; do diff --git a/src/hooks/ports/bonding b/src/hooks/ports/bonding index e268186..36bcf6c 100644 --- a/src/hooks/ports/bonding +++ b/src/hooks/ports/bonding @@ -39,16 +39,16 @@ hook_parse_cmdline() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - ADDRESS=$(cli_get_val ${1}) + ADDRESS=$(cli_get_val "${1}") ;; --miimon=*) - MIIMON=$(cli_get_val ${1}) + MIIMON=$(cli_get_val "${1}") ;; --mode=*) - MODE=$(cli_get_val ${1}) + MODE=$(cli_get_val "${1}") ;; +*) - local slave=$(cli_get_val ${1:1}) + local slave=$(cli_get_val "${1:1}") if port_exists "${slave}"; then if list_match "${slave}" ${SLAVES}; then @@ -61,7 +61,7 @@ hook_parse_cmdline() { fi ;; -*) - local slave=$(cli_get_val ${1:1}) + local slave=$(cli_get_val "${1:1}") if ! list_remove SLAVES "${slave}"; then warning "Port ${slave} is not a slave of this bonding device" fi @@ -84,7 +84,7 @@ hook_parse_cmdline() { } hook_new() { - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then return ${EXIT_ERROR} fi @@ -106,7 +106,7 @@ hook_new() { hook_edit() { local port=${1} - if ! hook_default_edit $@; then + if ! hook_default_edit "$@"; then return ${EXIT_ERROR} fi diff --git a/src/hooks/ports/dummy b/src/hooks/ports/dummy index 7e6f5d2..30de50e 100644 --- a/src/hooks/ports/dummy +++ b/src/hooks/ports/dummy @@ -31,7 +31,7 @@ hook_parse_cmdline() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - ADDRESS=$(cli_get_val ${1}) + ADDRESS=$(cli_get_val "${1}") ;; *) warning "Unknown argument '${1}'" @@ -53,7 +53,7 @@ hook_parse_cmdline() { } hook_new() { - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then return ${EXIT_ERROR} fi diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan index 3443614..2231de1 100644 --- a/src/hooks/ports/vlan +++ b/src/hooks/ports/vlan @@ -51,13 +51,13 @@ hook_new() { while [ $# -gt 0 ]; do case "${1}" in --parent-device=*) - PARENT_DEVICE=$(cli_get_val ${1}) + PARENT_DEVICE=$(cli_get_val "${1}") ;; --address=*) - ADDRESS=$(cli_get_val ${1}) + ADDRESS=$(cli_get_val "${1}") ;; --tag=*) - TAG=$(cli_get_val ${1}) + TAG=$(cli_get_val "${1}") ;; *) warning "Unknown argument '${1}'" @@ -83,7 +83,7 @@ hook_edit() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - ADDRESS=$(cli_get_val ${1}) + ADDRESS=$(cli_get_val "${1}") ;; *) warning "Unknown argument '${1}'" diff --git a/src/hooks/ports/wireless-adhoc b/src/hooks/ports/wireless-adhoc index 09ab402..d97bf55 100644 --- a/src/hooks/ports/wireless-adhoc +++ b/src/hooks/ports/wireless-adhoc @@ -45,22 +45,22 @@ hook_new() { while [ $# -gt 0 ]; do case "${1}" in --address=*) - ADDRESS=$(cli_get_val ${1}) + ADDRESS=$(cli_get_val "${1}") ;; --bssid=*) - BSSID=$(cli_get_val ${1}) + BSSID=$(cli_get_val "${1}") ;; --channel=*) - CHANNEL=$(cli_get_val ${1}) + CHANNEL=$(cli_get_val "${1}") ;; --mtu=*) MTU="$(cli_get_val "${1}")" ;; --phy=*) - PHY=$(cli_get_val ${1}) + PHY=$(cli_get_val "${1}") ;; --ssid=*) - SSID=$(cli_get_val ${1}) + SSID=$(cli_get_val "${1}") ;; *) warning "Ignoring unknown argument '${1}'" @@ -91,16 +91,16 @@ hook_edit() { while [ $# -gt 0 ]; do case "${1}" in --bssid=*) - BSSID=$(cli_get_val ${1}) + BSSID=$(cli_get_val "${1}") ;; --channel=*) - CHANNEL=$(cli_get_val ${1}) + CHANNEL=$(cli_get_val "${1}") ;; --mtu=*) MTU="$(cli_get_val "${1}")" ;; --ssid=*) - SSID=$(cli_get_val ${1}) + SSID=$(cli_get_val "${1}") ;; *) warning "Unknown argument '${1}'" diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap index 9c77bb1..e7f9193 100644 --- a/src/hooks/ports/wireless-ap +++ b/src/hooks/ports/wireless-ap @@ -57,28 +57,28 @@ hook_parse_cmdline() { while [ $# -gt 0 ]; do case "${1}" in --broadcast-ssid=*) - BROADCAST_SSID=$(cli_get_val ${1}) + BROADCAST_SSID=$(cli_get_val "${1}") ;; --channel=*) - CHANNEL=$(cli_get_val ${1}) + CHANNEL=$(cli_get_val "${1}") ;; --encryption=*) - ENCRYPTION=$(cli_get_val ${1}) + ENCRYPTION=$(cli_get_val "${1}") ;; --key=*) - KEY=$(cli_get_val ${1}) + KEY=$(cli_get_val "${1}") ;; --mac=*) - ADDRESS=$(cli_get_val ${1}) + ADDRESS=$(cli_get_val "${1}") ;; --mode=*) - MODE=$(cli_get_val ${1}) + MODE=$(cli_get_val "${1}") ;; --phy=*) - PHY=$(cli_get_val ${1}) + PHY=$(cli_get_val "${1}") ;; --ssid=*) - SSID=$(cli_get_val ${1}) + SSID=$(cli_get_val "${1}") ;; *) warning "Ignoring unknown argument '${1}'" @@ -93,7 +93,7 @@ hook_parse_cmdline() { } hook_new() { - if ! hook_parse_cmdline $@; then + if ! hook_parse_cmdline "$@"; then return ${EXIT_ERROR} fi @@ -109,7 +109,7 @@ hook_edit() { local port=${1} assert isset port - if ! hook_default_edit $@; then + if ! hook_default_edit "$@"; then return ${EXIT_ERROR} fi diff --git a/src/hooks/zones/6to4-tunnel b/src/hooks/zones/6to4-tunnel index f550741..bf20872 100644 --- a/src/hooks/zones/6to4-tunnel +++ b/src/hooks/zones/6to4-tunnel @@ -64,16 +64,16 @@ hook_parse_cmdline() { while [ $# -gt 0 ]; do case "${1}" in --server-address=*) - SERVER_ADDRESS=$(cli_get_val ${1}) + SERVER_ADDRESS=$(cli_get_val "${1}") ;; --local-ipv4-address=*) - LOCAL_ADDRESS=$(cli_get_val ${1}) + LOCAL_ADDRESS=$(cli_get_val "${1}") ;; --local-ipv6-address=*) - LOCAL_ADDRESS6=$(cli_get_val ${1}) + LOCAL_ADDRESS6=$(cli_get_val "${1}") ;; --auto-update-endpoint=*) - local val="$(cli_get_val ${1})" + local val="$(cli_get_val "${1}")" if enabled val; then AUTO_UPDATE_ENDPOINT="true" @@ -82,13 +82,13 @@ hook_parse_cmdline() { fi ;; --tunnel-id=*) - TUNNEL_ID="$(cli_get_val ${1})" + TUNNEL_ID="$(cli_get_val "${1}")" ;; --username=*) - USERNAME="$(cli_get_val ${1})" + USERNAME="$(cli_get_val "${1}")" ;; --password=*) - PASSWORD="$(cli_get_val ${1})" + PASSWORD="$(cli_get_val "${1}")" ;; *) echo "Unknown option: ${1}" >&2 diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge index 245f4c1..e90111c 100644 --- a/src/hooks/zones/bridge +++ b/src/hooks/zones/bridge @@ -268,7 +268,7 @@ hook_port_attach() { PRIORITY="$(cli_get_val "${arg}")" ;; esac - done <<< "$(args $@)" + done <<< "$(args "$@")" if ! zone_port_settings_write "${zone}" "${port}"; then exit ${EXIT_ERROR} @@ -294,7 +294,7 @@ hook_port_detach() { } hook_port_edit() { - hook_port_attach $@ + hook_port_attach "$@" } hook_port_up() { diff --git a/src/hooks/zones/modem b/src/hooks/zones/modem index ff21d45..1b4c3c0 100644 --- a/src/hooks/zones/modem +++ b/src/hooks/zones/modem @@ -94,39 +94,39 @@ hook_parse_cmdline() { while [ $# -gt 0 ]; do case "${1}" in --apn=*) - APN=$(cli_get_val ${1}) + APN=$(cli_get_val "${1}") ;; --auth=*) - AUTH=$(cli_get_val ${1}) + AUTH=$(cli_get_val "${1}") ;; --baudrate=*) - BAUDRATE=$(cli_get_val ${1}) + BAUDRATE=$(cli_get_val "${1}") assert isoneif "${BAUDRATE}" ${SERIAL_BAUDRATES} ;; --device=*) - DEVICE=$(cli_get_val ${1}) + DEVICE=$(cli_get_val "${1}") ;; --imsi=*) IMSI="$(cli_get_val "${1}")" ;; --monitor-device=*) - MONITOR_DEVICE=$(cli_get_val ${1}) + MONITOR_DEVICE=$(cli_get_val "${1}") ;; --mtu=*) - MTU=$(cli_get_val ${1}) + MTU=$(cli_get_val "${1}") assert isinteger ${MTU} ;; --password=*) - PASSWORD=$(cli_get_val ${1}) + PASSWORD=$(cli_get_val "${1}") ;; --phone-number=*) - PHONE_NUMBER=$(cli_get_val ${1}) + PHONE_NUMBER=$(cli_get_val "${1}") ;; --pin=*) - PIN=$(cli_get_val ${1}) + PIN=$(cli_get_val "${1}") ;; --username=*) - USERNAME=$(cli_get_val ${1}) + USERNAME=$(cli_get_val "${1}") ;; *) echo "Unknown argument: ${1}" >&2 diff --git a/src/hooks/zones/pppoe b/src/hooks/zones/pppoe index 5b44b8c..021d89b 100644 --- a/src/hooks/zones/pppoe +++ b/src/hooks/zones/pppoe @@ -64,10 +64,10 @@ hook_parse_cmdline() { while [ $# -gt 0 ]; do case "${1}" in --access-concentrator=*) - ACCESS_CONCENTRATOR=$(cli_get_val ${1}) + ACCESS_CONCENTRATOR=$(cli_get_val "${1}") ;; --auth=*) - AUTH=$(cli_get_val ${1}) + AUTH=$(cli_get_val "${1}") ;; --ipv6=*) local value="$(cli_get_val "${1}")" @@ -78,19 +78,19 @@ hook_parse_cmdline() { fi ;; --mtu=*) - MTU=$(cli_get_val ${1}) + MTU=$(cli_get_val "${1}") ;; --password=*) - PASSWORD=$(cli_get_val ${1}) + PASSWORD=$(cli_get_val "${1}") ;; --prefix-delegation=*) PREFIX_DELEGATION="$(cli_get_bool "${1}")" ;; --service-name=*) - SERVICE_NAME=$(cli_get_val ${1}) + SERVICE_NAME=$(cli_get_val "${1}") ;; --username=*) - USERNAME=$(cli_get_val ${1}) + USERNAME=$(cli_get_val "${1}") ;; *) warning "Unknown argument: ${1}" >&2 diff --git a/src/hooks/zones/wireless b/src/hooks/zones/wireless index bd202f2..0bb4aa8 100644 --- a/src/hooks/zones/wireless +++ b/src/hooks/zones/wireless @@ -48,19 +48,19 @@ hook_parse_cmdline() { while [ $# -gt 0 ]; do case "${1}" in --phy=*|--parent-device=*) - PHY=$(cli_get_val ${1}) + PHY=$(cli_get_val "${1}") ;; --encryption-mode=*) - ENCRYPTION_MODE=$(cli_get_val ${1}) + ENCRYPTION_MODE=$(cli_get_val "${1}") ;; --address=*) - ADDRESS=$(cli_get_val ${1}) + ADDRESS=$(cli_get_val "${1}") ;; --ssid=*) - SSID=$(cli_get_val ${1}) + SSID=$(cli_get_val "${1}") ;; --key=*) - KEY=$(cli_get_val ${1}) + KEY=$(cli_get_val "${1}") ;; *) warning "Unrecognized option: ${1}" diff --git a/src/network b/src/network index 547bab1..4460f0b 100644 --- a/src/network +++ b/src/network @@ -39,13 +39,13 @@ done network_settings_read cli_settings() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-settings exit ${EXIT_OK} fi if [ -n "${1}" ]; then - network_settings_set $@ + network_settings_set "$@" network_settings_write else network_settings_print @@ -53,7 +53,7 @@ cli_settings() { } cli_device() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-device exit ${EXIT_OK} fi @@ -63,7 +63,7 @@ cli_device() { case "${action}" in list) - cli_device_list $@ + cli_device_list "$@" ;; *) local device="${action}" @@ -79,22 +79,22 @@ cli_device() { case "${action}" in discover) - cli_device_discover ${device} $@ + cli_device_discover ${device} "$@" ;; identify) - device_identify "${device}" $@ + device_identify "${device}" "$@" ;; monitor) - cli_device_monitor "${device}" $@ + cli_device_monitor "${device}" "$@" ;; status) cli_device_status ${device} ;; unlock) - cli_device_serial_unlock ${device} $@ + cli_device_serial_unlock ${device} "$@" ;; ussd) - cli_device_send_ussd_command "${device}" $@ + cli_device_send_ussd_command "${device}" "$@" ;; *) cli_show_man network-device @@ -339,7 +339,7 @@ cli_device_discover() { } cli_device_serial_unlock() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-device exit ${EXIT_OK} fi @@ -482,7 +482,7 @@ cli_device_list() { } cli_hostname() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network exit ${EXIT_OK} fi @@ -501,7 +501,7 @@ cli_hostname() { } cli_port() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-port exit ${EXIT_OK} fi @@ -516,13 +516,13 @@ cli_port() { case "${action}" in edit|create|remove|up|down|status|identify) - port_${action} "${port}" $@ + port_${action} "${port}" "$@" ;; color) - color_cli "port" "${port}" $@ + color_cli "port" "${port}" "$@" ;; description) - description_cli "port" "${port}" $@ + description_cli "port" "${port}" "$@" ;; *) error "Unrecognized argument: ${action}" @@ -535,7 +535,7 @@ cli_port() { case "${action}" in new|destroy) - port_${action} $@ + port_${action} "$@" ;; *) error "Unrecognized argument: ${action}" @@ -546,7 +546,7 @@ cli_port() { } cli_zone() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-zone exit ${EXIT_OK} fi @@ -574,19 +574,19 @@ cli_zone() { case "${action}" in port) - cli_zone_port "${zone}" $@ + cli_zone_port "${zone}" "$@" ;; rename) - cli_zone_rename "${zone}" $@ + cli_zone_rename "${zone}" "$@" ;; config|disable|down|edit|enable|identify|status|up) - zone_${action} ${zone} $@ + zone_${action} ${zone} "$@" ;; color) - color_cli "zone" "${zone}" $@ + color_cli "zone" "${zone}" "$@" ;; description) - description_cli "zone" ${zone} $@ + description_cli "zone" ${zone} "$@" ;; *) error "Unrecognized argument: ${action}" @@ -600,10 +600,10 @@ cli_zone() { case "${action}" in new) - cli_zone_new $@ + cli_zone_new "$@" ;; destroy) - cli_zone_destroy $@ + cli_zone_destroy "$@" ;; ""|*) if [ -n "${action}" ]; then @@ -619,19 +619,19 @@ cli_zone() { } cli_zone_new() { - if cli_help_requested $@ || [ $# -lt 2 ]; then + if cli_help_requested "$@" || [ $# -lt 2 ]; then cli_show_man network-zone-new exit ${EXIT_OK} fi - zone_new $@ + zone_new "$@" } # Removes a zone either immediately, if it is currently down, # or adds a tag that the removal will be done when the zone # is brought down the next time. cli_zone_destroy() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-zone exit ${EXIT_OK} fi @@ -651,7 +651,7 @@ cli_zone_destroy() { } cli_zone_port() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-zone-port exit ${EXIT_OK} fi @@ -666,7 +666,7 @@ cli_zone_port() { case "${action}" in edit) - zone_port_edit "${zone}" "${port}" $@ + zone_port_edit "${zone}" "${port}" "$@" ;; *) error "Unrecognised argument: ${action}" @@ -679,10 +679,10 @@ cli_zone_port() { case "${action}" in attach) - zone_port_attach "${zone}" $@ + zone_port_attach "${zone}" "$@" ;; detach) - zone_port_detach "${zone}" $@ + zone_port_detach "${zone}" "$@" ;; *) error "Unrecognised argument: ${action}" @@ -695,7 +695,7 @@ cli_zone_port() { } cli_zone_rename() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-zone exit ${EXIT_OK} fi @@ -745,7 +745,7 @@ cli_list_hooks() { local type=${1} shift - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-zone exit ${EXIT_OK} fi @@ -765,7 +765,7 @@ cli_dhcpd() { local proto=${1} shift - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-dhcp exit ${EXIT_OK} fi @@ -775,7 +775,7 @@ cli_dhcpd() { case "${action}" in edit) - dhcpd_edit ${proto} $@ + dhcpd_edit ${proto} "$@" ;; start) dhcpd_start ${proto} @@ -793,10 +793,10 @@ cli_dhcpd() { dhcpd_reload ${proto} ;; subnet) - cli_dhcpd_subnet ${proto} $@ + cli_dhcpd_subnet ${proto} "$@" ;; show|"") - cli_dhcpd_show ${proto} $@ + cli_dhcpd_show ${proto} "$@" ;; *) error "Unrecognized action: ${action}" @@ -885,7 +885,7 @@ cli_dhcpd_subnet() { local proto=${1} shift - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-dhcp-subnet exit ${EXIT_OK} fi @@ -895,10 +895,10 @@ cli_dhcpd_subnet() { case "${action}" in new) - dhcpd_subnet_new ${proto} $@ + dhcpd_subnet_new ${proto} "$@" ;; remove) - dhcpd_subnet_remove ${proto} $@ + dhcpd_subnet_remove ${proto} "$@" ;; *:*/*|*.*.*.*/*) local subnet=${action} @@ -914,7 +914,7 @@ cli_dhcpd_subnet() { case "${action}" in edit) - dhcpd_subnet_edit ${proto} ${subnet} $@ + dhcpd_subnet_edit ${proto} ${subnet} "$@" local ret=$? if [ ${ret} -eq ${EXIT_OK} ]; then @@ -923,15 +923,15 @@ cli_dhcpd_subnet() { exit ${ret} ;; range) - cli_dhcpd_subnet_range ${proto} ${subnet} $@ + cli_dhcpd_subnet_range ${proto} ${subnet} "$@" exit $? ;; show) - cli_dhcpd_subnet_show ${proto} ${subnet} $@ + cli_dhcpd_subnet_show ${proto} ${subnet} "$@" exit $? ;; options) - cli_dhcpd_subnet_options ${proto} ${subnet} $@ + cli_dhcpd_subnet_options ${proto} ${subnet} "$@" exit $? ;; *) @@ -968,10 +968,10 @@ cli_dhcpd_subnet_range() { case "${action}" in new) - dhcpd_subnet_range_new ${proto} ${subnet} $@ || exit ${EXIT_ERROR} + dhcpd_subnet_range_new ${proto} ${subnet} "$@" || exit ${EXIT_ERROR} ;; remove) - dhcpd_subnet_range_remove ${proto} ${subnet} $@ || exit ${EXIT_ERROR} + dhcpd_subnet_range_remove ${proto} ${subnet} "$@" || exit ${EXIT_ERROR} ;; *) error "Unrecognized action: ${action}" @@ -1050,7 +1050,7 @@ cli_dhcpd_subnet_options() { case "${1}" in *=*) key=$(cli_get_key ${1}) - val=$(cli_get_val ${1}) + val=$(cli_get_val "${1}") dhcpd_subnet_option_set ${proto} ${subnet} ${key} ${val} esac @@ -1059,12 +1059,12 @@ cli_dhcpd_subnet_options() { } cli_start() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network exit ${EXIT_OK} fi - local zones=$(zones_get $@) + local zones=$(zones_get "$@") local zone for zone in ${zones}; do @@ -1075,12 +1075,12 @@ cli_start() { } cli_stop() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network exit ${EXIT_OK} fi - local zones=$(zones_get $@) + local zones=$(zones_get "$@") local zone for zone in ${zones}; do @@ -1091,21 +1091,21 @@ cli_stop() { } cli_restart() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network exit ${EXIT_OK} fi - cli_stop $@ + cli_stop "$@" # Give the system some time to calm down sleep ${TIMEOUT_RESTART} - cli_start $@ + cli_start "$@" } cli_status() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network exit ${EXIT_OK} fi @@ -1116,7 +1116,7 @@ cli_status() { local log_disable_stdout=${LOG_DISABLE_STDOUT} LOG_DISABLE_STDOUT="true" - local zones=$(zones_get $@) + local zones=$(zones_get "$@") local zone for zone in ${zones}; do @@ -1128,7 +1128,7 @@ cli_status() { } cli_reset() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network exit ${EXIT_OK} fi @@ -1225,7 +1225,7 @@ cli_help() { } cli_dns_server() { - if cli_help_requested $@; then + if cli_help_requested "$@"; then cli_show_man network-dns-server exit ${EXIT_OK} fi @@ -1288,22 +1288,22 @@ cli_raw() { db_dump ;; ipsec-connection-exists) - ipsec_connection_exists $@ + ipsec_connection_exists "$@" ;; list-devices) device_list ;; list-dhcpd-ranges-of-subnet) - dhcpd_subnet_range_list $@ + dhcpd_subnet_range_list "$@" ;; list-dhcpd-settings) - dhcpd_global_settings_list $@ + dhcpd_global_settings_list "$@" ;; list-dhcpd-subnets) - dhcpd_subnet_list $@ + dhcpd_subnet_list "$@" ;; list-dhcpd-subnet-options) - dhcpd_subnet_options_list $@ + dhcpd_subnet_options_list "$@" ;; list-dns-servers) dns_server_list @@ -1312,7 +1312,7 @@ cli_raw() { port_list_free ;; list-hooks) - hook_list $@ + hook_list "$@" ;; list-ipsec-connections) ipsec_list_connections @@ -1321,7 +1321,7 @@ cli_raw() { port_list ;; list-ports-of-zone) - zone_get_ports $@ + zone_get_ports "$@" ;; list-vpn-security-policies-all) vpn_security_policies_list_all @@ -1336,22 +1336,22 @@ cli_raw() { zones_get_next_free ;; list-zone-config-ids) - zone_config_list_ids $@ + zone_config_list_ids "$@" ;; list-zone-config-hids) - zone_config_list_hids $@ + zone_config_list_hids "$@" ;; vpn-security-policy-exists) - vpn_security_policy_exists $@ + vpn_security_policy_exists "$@" ;; zone-name-is-valid) - zone_name_is_valid $@ + zone_name_is_valid "$@" ;; zone-config-id-is-valid) - zone_config_id_is_valid $@ + zone_config_id_is_valid "$@" ;; zone-config-hid-is-valid) - zone_config_hid_is_valid $@ + zone_config_hid_is_valid "$@" ;; *) error "No such command: ${cmd}" @@ -1369,25 +1369,25 @@ case "${action}" in ;; settings|hostname|port|device|zone|start|stop|restart|status|reset|route|vpn) - cli_${action} $@ + cli_${action} "$@" ;; # DHCP server configuration (automatically detects which protocol to use). dhcpv6|dhcpv4) - cli_dhcpd ${action/dhcp/ip} $@ + cli_dhcpd ${action/dhcp/ip} "$@" ;; # DNS server configuration. dns-server) - cli_dns_server $@ + cli_dns_server "$@" ;; ""|help|--help|-h) - cli_help $@ + cli_help "$@" ;; raw) - cli_raw $@ + cli_raw "$@" ;; *) -- 2.6.3

1 0

[PATCH] ivpn-security-policies: fix +/- syntax handling for group type and integrity
by Jonatan Schlag 16 Aug '17

16 Aug '17

Fixes: #11445 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.vpn-security-policies | 213 +++++++++++++++++++------- 1 file changed, 154 insertions(+), 59 deletions(-) diff --git a/src/functions/functions.vpn-security-policies b/src/functions/functions.vpn-security-policies index cdd4e83..d5b43b0 100644 --- a/src/functions/functions.vpn-security-policies +++ b/src/functions/functions.vpn-security-policies @@ -658,46 +658,87 @@ vpn_security_policies_group_type(){ # Remove duplicated entries to proceed the list safely GROUP_TYPE="$(list_unique ${GROUP_TYPE})" + local group_types_added + local group_types_removed + local group_types_set + while [ $# -gt 0 ]; do - case "${1}" in + local arg="${1}" + + case "${arg}" in + +*) + list_append group_types_added "${arg:1}" + ;; -*) - value=${1#-} - # Check if the group type is in the list of group types and - # check if the list has after removing this group type at leatst one valid value - if list_match ${value} ${GROUP_TYPE}; then - list_remove GROUP_TYPE ${value} - else - # We do not break here because this error does not break the processing of the next maybe valid values. - log ERROR "Can not remove ${value} from the list of group types because ${value} is not in the list." - fi + list_append group_types_removed "${arg:1}" ;; - +*) - value=${1#+} - # Check if the group type is in the list of supported group types. - if ! isoneof value ${!VPN_SUPPORTED_GROUP_TYPES[@]}; then - # We do not break here because the processing of other maybe valid values are indepent from this error. - log ERROR "${value} is not a supported group type and can thats why not added to the list of group types." - else - if list_match ${value} ${GROUP_TYPE}; then - log WARNING "${value} is already in the list of group-types of this policy." - else - list_append GROUP_TYPE ${value} - fi - fi + [A-Z0-9]*) + list_append group_types_set "${arg}" + ;; + *) + error "Invalid argument: ${arg}" + return ${EXIT_ERROR} ;; esac shift done - # Check if the list contain at least one valid group-type - if [ $(list_length ${GROUP_TYPE}) -ge 1 ]; then - if ! vpn_security_policies_write_config_key ${name} "GROUP_TYPE" ${GROUP_TYPE}; then - log ERROR "The changes for the vpn security policy ${name} could not be written." - fi + # Check if the user is trying a mixed operation + if ! list_is_empty group_types_set && (! list_is_empty group_types_added || ! list_is_empty group_types_removed); then + error "You cannot reset the group type list and add or remove group types at the same time" + return ${EXIT_ERROR} + fi + + # Set new group type list + if ! list_is_empty group_types_set; then + # Check if all group types are valid + local group_type + for group_type in ${group_types_set}; do + if ! vpn_security_policies_group_type_supported ${group_type}; then + error "Unsupported group type: ${group_type}" + return ${EXIT_ERROR} + fi + done + + GROUP_TYPE="${group_types_set}" + + # Perform incremental updates else - log ERROR "After proceding all group types the list is empty and thats why no changes are written." + local group_type + + # Perform all removals + for group_type in ${group_types_removed}; do + if ! list_remove GROUP_TYPE ${group_type}; then + warning "${group_type} was not on the list and could not be removed" + fi + done + + for group_type in ${group_types_added}; do + if vpn_security_policies_group_type_supported ${group_type}; then + if ! list_append_unique GROUP_TYPE ${group_type}; then + warning "${group_type} is already on the group type list" + fi + else + warning "${group_type} is unknown or unsupported and could not be added" + fi + done + fi + + # Check if the list contain at least one valid group_type + if list_is_empty GROUP_TYPE; then + error "Cannot save an empty group type list" return ${EXIT_ERROR} fi + + # Save everything + if ! vpn_security_policies_write_config_key ${name} "GROUP_TYPE" ${GROUP_TYPE}; then + log ERROR "The changes for the vpn security policy ${name} could not be written." + fi + + cli_headline 1 "Current group type list for ${name}:" + for group_type in ${GROUP_TYPE}; do + cli_print_fmt1 1 "${group_type}" "${VPN_SUPPORTED_GROUP_TYPES[${group_type}]}" + done } # This function parses the parameters for the 'integrity' command @@ -706,7 +747,7 @@ vpn_security_policies_integrity(){ shift if [ $# -eq 0 ]; then - log ERROR "You must pass at least one value after integrity." + log ERROR "You must pass at least one value after integrity" return ${EXIT_ERROR} fi @@ -718,46 +759,87 @@ vpn_security_policies_integrity(){ # Remove duplicated entries to proceed the list safely INTEGRITY="$(list_unique ${INTEGRITY})" + local integritys_added + local integritys_removed + local integritys_set + while [ $# -gt 0 ]; do - case "${1}" in + local arg="${1}" + + case "${arg}" in + +*) + list_append integritys_added "${arg:1}" + ;; -*) - value=${1#-} - # Check if the integrity hash is in the list of integrity hashes and - # check if the list has after removing this integrity hash at least one valid value - if list_match ${value} ${INTEGRITY}; then - list_remove INTEGRITY ${value} - else - # We do not break here because the processing of other maybe valid values are indepent from this error. - log ERROR "Can not remove ${value} from the list of integrity hashes because ${value} is not in the list." - fi + list_append integritys_removed "${arg:1}" ;; - +*) - value=${1#+} - # Check if the Ciphers is in the list of supported integrity hashes. - if ! isoneof value ${!VPN_SUPPORTED_INTEGRITY[@]}; then - # We do not break here because the processing of other maybe valid values are indepent from this error. - log ERROR "${value} is not a supported integrity hash and can thats why not added to the list of integrity hashes." - else - if list_match ${value} ${INTEGRITY}; then - log WARNING "${value} is already in the list of integrety hashes of this policy." - else - list_append INTEGRITY ${value} - fi - fi + [A-Z0-9]*) + list_append integritys_set "${arg}" + ;; + *) + error "Invalid argument: ${arg}" + return ${EXIT_ERROR} ;; esac shift done - # Check if the list contain at least one valid group-type - if [ $(list_length ${INTEGRITY}) -ge 1 ]; then - if ! vpn_security_policies_write_config_key ${name} "INTEGRITY" ${INTEGRITY}; then - log ERROR "The changes for the vpn security policy ${name} could not be written." - fi + # Check if the user is trying a mixed operation + if ! list_is_empty integritys_set && (! list_is_empty integritys_added || ! list_is_empty integritys_removed); then + error "You cannot reset the integrity hashes list and add or remove integrity hashes at the same time" + return ${EXIT_ERROR} + fi + + # Set new integrity list + if ! list_is_empty integritys_set; then + # Check if all integrity hashes are valid + local integrity + for integrity in ${integritys_set}; do + if ! vpn_security_policies_integrity_supported ${integrity}; then + error "Unsupported integrity hash: ${integrity}" + return ${EXIT_ERROR} + fi + done + + INTEGRITY="${integritys_set}" + + # Perform incremental updates else - log ERROR "After proceding all integrity hashes the list is empty and thats why no changes are written." + local integrity + + # Perform all removals + for integrity in ${integritys_removed}; do + if ! list_remove INTEGRITY ${integrity}; then + warning "${integrity} was not on the list and could not be removed" + fi + done + + for integrity in ${integritys_added}; do + if vpn_security_policies_integrity_supported ${integrity}; then + if ! list_append_unique INTEGRITY ${integrity}; then + warning "${integrity} is already on the integrity list" + fi + else + warning "${integrity} is unknown or unsupported and could not be added" + fi + done + fi + + # Check if the list contain at least one valid integrity + if list_is_empty INTEGRITY; then + error "Cannot save an empty integrity hashes list" return ${EXIT_ERROR} fi + + # Save everything + if ! vpn_security_policies_write_config_key ${name} "INTEGRITY" ${INTEGRITY}; then + log ERROR "The changes for the vpn security policy ${name} could not be written." + fi + + cli_headline 1 "Current integrity hashes list for ${name}:" + for integrity in ${INTEGRITY}; do + cli_print_fmt1 1 "${integrity}" "${VPN_SUPPORTED_INTEGRITY[${integrity}]}" + done } # This function parses the parameters for the 'key-exchange' command @@ -917,6 +999,19 @@ vpn_security_policies_cipher_supported() { list_match ${cipher} ${!VPN_SUPPORTED_CIPHERS[@]} } + +vpn_security_policies_group_type_supported() { + local group_type=${1} + + list_match ${group_type} ${!VPN_SUPPORTED_GROUP_TYPES[@]} +} + +vpn_security_policies_integrity_supported() { + local integrity=${1} + + list_match ${integrity} ${!VPN_SUPPORTED_INTEGRITY[@]} +} + vpn_security_policies_cipher_is_aead() { local cipher=${1} -- 2.6.3

1 0

[PATCH 1/5] zone: zone_config_check_same_setting check for config to edit
by Jonatan Schlag 13 Aug '17

13 Aug '17

We now check if we get the config, which we edit in this moment and when we continue. Fixes: #11451 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index 1eb492f..941314d 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -1155,12 +1155,13 @@ zone_config_check_same_setting() { # with the same setting is already configured for this zone. # Returns True when yes and False when no. - assert [ $# -eq 4 ] + assert [ $# -eq 5 ] local zone=${1} local hook=${2} - local key=${3} - local value=${4} + local id=${3} + local key=${4} + local value=${5} # The key should be local for this function local ${key} @@ -1171,6 +1172,12 @@ zone_config_check_same_setting() { if [[ $(zone_config_get_hook "${zone}" "${config}") != ${hook} ]]; then continue fi + + # Check if we get the config we want to create or edit (we must ignore this config on edit) + if [[ "${hook}.${id}" = "${config}" ]]; then + continue + fi + # Get the value of the key for a given function zone_config_settings_read "${zone}" "${config}" \ --ignore-superfluous-settings "${key}" -- 2.6.3

2 5

[PATCH 1/2] ipsec: fix enable and disable
by Jonatan Schlag 05 Aug '17

05 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 4b8ce1b..14d5ef6 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -222,8 +222,6 @@ ipsec_connection_disable() { return ${EXIT_ERROR} fi - ipsec_reload ${connection} - # Configure strongswan autostart ipsec_strongswan_autostart } @@ -236,8 +234,6 @@ ipsec_connection_enable() { return ${EXIT_ERROR} fi - ipsec_reload "${connection}" - # Configure strongswan autostart ipsec_strongswan_autostart } -- 2.6.3

1 1

[PATCH] ipsec: add status feature
by Jonatan Schlag 04 Aug '17

04 Aug '17

We can now disable and enable IPsec connections. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec | 44 ++++++++++++++++++++++++--- src/functions/functions.vpn-security-policies | 4 ++- 2 files changed, 43 insertions(+), 5 deletions(-) diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 015b3b8..32a6a2c 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -33,13 +33,15 @@ IPSEC_CONNECTION_CONFIG_SETTINGS="\ PSK \ REMOTE_ID \ REMOTE_PREFIX \ - SECURITY_POLICY" + SECURITY_POLICY \ + ENABLED" # Default values IPSEC_DEFAULT_AUTH_MODE="PSK" IPSEC_DEFAULT_DPD_ACTION="restart" IPSEC_DEFAULT_DPD_DELAY="30" IPSEC_DEFAULT_DPD_TIMEOUT="120" +IPSEC_DEFAULT_ENABLED="true" IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0" IPSEC_DEFAULT_MODE="tunnel" IPSEC_DEFAULT_SECURITY_POLICY="system" @@ -71,7 +73,7 @@ cli_ipsec_connection() { shift 2 case "${key}" in - authentication|down|dpd|inactivity_timeout|local|mode|peer|remote|security_policy|start_action|up) + authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|remote|security_policy|start_action|up) ipsec_connection_${key} ${connection} $@ ;; show) @@ -198,6 +200,28 @@ cli_ipsec_connection_show() { return ${EXIT_OK} } +ipsec_connection_disable() { + local connection=${1} + + if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "false"; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + ipsec_reload ${connection} +} + +ipsec_connection_enable() { + local connection=${1} + + if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "true"; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + ipsec_reload "${connection}" +} + # This function writes all values to a via ${connection} specificated VPN IPsec configuration file ipsec_connection_write_config() { assert [ $# -ge 1 ] @@ -304,11 +328,22 @@ ipsec_strongswan_load() { ipsec_reload() { local connection=${1} - if ! ipsec_connection_to_strongswan ${connection}; then - log ERROR "Could not generate strongswan config for ${connnection}" + local ENABLED + + if ! ipsec_connection_read_config "${connection}" "ENABLED"; then + log ERROR "Could not read configuration for IPsec connection ${connection}" return ${EXIT_ERROR} fi + if enabled ${ENABLED}; then + if ! ipsec_connection_to_strongswan ${connection}; then + log ERROR "Could not generate strongswan config for ${connnection}" + return ${EXIT_ERROR} + fi + else + unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf" + fi + ipsec_strongswan_load } @@ -913,6 +948,7 @@ ipsec_connection_new() { DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION} DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY} DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT} + ENABLED=${IPSEC_DEFAULT_ENABLED} MODE=${IPSEC_DEFAULT_MODE} START_ACTION=${IPSEC_DEFAULT_START_ACTION} diff --git a/src/functions/functions.vpn-security-policies b/src/functions/functions.vpn-security-policies index 670c12d..294f0da 100644 --- a/src/functions/functions.vpn-security-policies +++ b/src/functions/functions.vpn-security-policies @@ -346,11 +346,13 @@ vpn_security_policies_reload() { local connection for connection in $(ipsec_list_connections); do + local SECURITY_POLICY ENABLED + if ! ipsec_connection_read_config "${connection}" "SECURITY_POLICY"; then continue fi - if [[ "${SECURITY_POLICY}" = "${name}" ]]; then + if [[ "${SECURITY_POLICY}" = "${name}" ]] && enabled ENABLED; then if ! ipsec_connection_to_strongswan "${connection}"; then log ERROR "Could not generate strongswan config for ${connnection}" fi -- 2.6.3

1 0

[PATCH 1/2] ipsec: reload connection when the config changes
by Jonatan Schlag 04 Aug '17

04 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 70931ed..6dc4d5b 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -285,7 +285,17 @@ ipsec_connection_exists() { # Reloads the connection after config changes ipsec_reload() { - return ${EXIT_TRUE} + local connection=${1} + + if ! ipsec_connection_to_strongswan ${connection}; then + log ERROR "Could not generate strongswan config for ${connnection}" + return ${EXIT_ERROR} + fi + + if ! cmd swanctl --load-all; then + log ERROR "Could not reload strongswan config" + return ${EXIT_ERROR} + fi } # Handle the cli after authentification -- 2.6.3

1 1

[PATCH] bash-autocompletion: up and down for ipsec connections
by Jonatan Schlag 04 Aug '17

04 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/bash-completion/network | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/bash-completion/network b/src/bash-completion/network index 668c699..5ddc8db 100644 --- a/src/bash-completion/network +++ b/src/bash-completion/network @@ -413,7 +413,7 @@ _network_vpn_ipsec_connection_subcommands() { shift local words=( $@ ) - local commands="authentication inactivity-timeout local mode peer remote security-policy show" + local commands="authentication down inactivity-timeout local mode peer remote security-policy show up" local cmd="$(_network_find_on_cmdline "${commands}")" if [[ -z "${cmd}" ]]; then COMPREPLY=( $(compgen -W "${commands}" -- "${cur}") ) -- 2.6.3

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

network August 2017